{
  "Event": {
    "analysis": "1",
    "date": "2026-06-11",
    "extends_uuid": "",
    "info": "[Threat Intel] Targets Education Sector with Oracle PeopleSoft Exploit",
    "protected": false,
    "publish_timestamp": "1782230723",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782230723",
    "uuid": "612a10dd-f897-4556-ab31-f50a1b128318",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#6e57da",
        "local": false,
        "name": "misp-galaxy:producer=\"Mandiant\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Guessing - T1110.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#aff0ae",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Permission Groups Discovery - T1069\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#eb2300",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Defacement - T1491\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#36d931",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#08b028",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3970d7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Education\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"ShinyHunters\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Cybercrime\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578834",
        "to_ids": false,
        "type": "link",
        "uuid": "7a77954a-4b80-492e-bf02-1d980052572f",
        "value": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578834",
        "to_ids": false,
        "type": "text",
        "uuid": "8e992d6e-1ad9-4442-971a-d9feea431886",
        "value": "Between May 27 and June 9, 2026, UNC6240 (ShinyHunters) conducted an active compromise and extortion campaign targeting Oracle PeopleSoft application infrastructure. The threat actor exploited CVE-2026-35273, a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component, as a zero-day before Oracle's June 10, 2026 advisory. Over 100 organizations were potentially affected, with 68 percent operating in higher education and most based in the United States. Attackers deployed customized MeshCentral agents masquerading as Microsoft Azure services, established C2 infrastructure at azurenetfiles.net, and used lateral movement scripts to propagate across internal networks. The campaign culminated in data exfiltration and publication of stolen data on the ShinyHunters Data Leak Site on June 9, 2026. Compromised systems received defacement markers and extortion notices."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578834",
        "to_ids": false,
        "type": "text",
        "uuid": "5aff0f4a-57b1-4a5e-9155-983ffe310da7",
        "value": "Name: Targets Education Sector with Oracle PeopleSoft Exploit\nAuthor: AlienVault\nAdversary: UNC6240\nTags: [\"higher education\", \"data extortion\", \"oracle peoplesoft\", \"shinyhunters\", \"lateral movement\", \"zero-day exploitation\", \"meshcentral\", \"cve-2026-35273\", \"unc6240\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"MeshCentral\"]\nAttack_ids: [\"T1560.001\", \"T1110.001\", \"T1133\", \"T1069\", \"T1114\", \"T1036.005\", \"T1021.004\", \"T1190\", \"T1491\", \"T1505.003\", \"T1083\", \"T1552.001\", \"T1041\", \"T1059.004\", \"T1078\", \"T1027\", \"T1486\", \"T1573.002\", \"T1071.001\", \"T1018\"]\nIndustries: [\"Education\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782096543",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "71a8632e-98d7-4165-9a22-852549b7c2ed",
        "value": "UNC6240",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"ShinyHunters\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:producer=\"Google Cloud Blog\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102205",
        "to_ids": true,
        "type": "url",
        "uuid": "1b4b5d76-afd3-4689-b6e8-4d0a9a778fcf",
        "value": "http://azurenetfiles.net:443/agent.ashx",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102226",
        "to_ids": true,
        "type": "domain",
        "uuid": "0b35c7b9-bb75-47db-a571-7cfad3d31aad",
        "value": "azurenetfiles.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578834",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "df147791-f78e-40ed-9b5c-3f848d4a2901",
        "value": "CVE-2026-35273"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102247",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f7fe24af-24d9-4b52-8b98-3be5b5ebc3c3",
        "value": "176.120.22.24",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Staging & C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102268",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "573198f7-fcbf-4d96-ae0f-7431e69e66ca",
        "value": "142.11.200.186",
        "Tag": [
          {
            "colour": "#c61cc6",
            "local": false,
            "name": "asn:asn=\"54290\"",
            "relationship_type": ""
          },
          {
            "colour": "#a9445b",
            "local": false,
            "name": "asn:as-owner=\"HOSTWINDS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Staging & C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102289",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "48128adf-0ec6-4b98-a11c-3718909e2714",
        "value": "142.11.200.187",
        "Tag": [
          {
            "colour": "#c61cc6",
            "local": false,
            "name": "asn:asn=\"54290\"",
            "relationship_type": ""
          },
          {
            "colour": "#a9445b",
            "local": false,
            "name": "asn:as-owner=\"HOSTWINDS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Staging & C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102310",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c8211db3-1871-469d-ba48-f41ff025a785",
        "value": "142.11.200.188",
        "Tag": [
          {
            "colour": "#c61cc6",
            "local": false,
            "name": "asn:asn=\"54290\"",
            "relationship_type": ""
          },
          {
            "colour": "#a9445b",
            "local": false,
            "name": "asn:as-owner=\"HOSTWINDS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Staging & C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102331",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c3fec6fd-8f15-4a48-a8d7-0a2ae42ecebb",
        "value": "142.11.200.189",
        "Tag": [
          {
            "colour": "#c61cc6",
            "local": false,
            "name": "asn:asn=\"54290\"",
            "relationship_type": ""
          },
          {
            "colour": "#a9445b",
            "local": false,
            "name": "asn:as-owner=\"HOSTWINDS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Staging & C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782102352",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1910a33d-c38d-47a4-8bd4-eccda4ae3c9c",
        "value": "142.11.200.190",
        "Tag": [
          {
            "colour": "#c61cc6",
            "local": false,
            "name": "asn:asn=\"54290\"",
            "relationship_type": ""
          },
          {
            "colour": "#a9445b",
            "local": false,
            "name": "asn:as-owner=\"HOSTWINDS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782102373",
        "uuid": "9217ed7a-4767-4e79-9164-86c15250b7eb",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782102373",
            "to_ids": true,
            "type": "md5",
            "uuid": "51f1380a-500f-4520-b0b0-d64e95703760",
            "value": "ebcf977806f68af3147e0b78b55f6aed",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782101765",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4c0385d7-748e-48d5-b289-c5342b4c52be",
            "value": "cc19e502e4201cc974c753b96429027925224f53",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782101765",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9a01d481-829c-4fb8-8241-898f7f63bf4d",
            "value": "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782099716",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "2dcb7b1b-47a0-408f-8888-ad0534af26c5",
            "value": "49152:DfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPaUP:DfEYnnfKthWq+1jJWZPa8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782099716",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ed16e026-d713-402b-b377-8805078aa036",
            "value": "3856496"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782099716",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4a37926f-9db0-4090-b24b-e299ba042223",
            "value": "036066655d65156562c01001a0f00b8z4035z12z384z267z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782099716",
            "to_ids": true,
            "type": "filename",
            "uuid": "d6148a59-3858-4d93-9977-eaf11653c0b2",
            "value": "s5x40.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 22/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782099716",
            "to_ids": false,
            "type": "text",
            "uuid": "0d8fe1fb-5c1d-41b4-ad2c-f4cab8702fc3",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:44/70\nFirst Submission:2026-06-06T04:58:06.000000+00:00\nLast Submission:2026-06-11T21:48:52.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782102394",
        "uuid": "4df7175a-df81-4764-bc48-ae4399a3743f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782102394",
            "to_ids": true,
            "type": "md5",
            "uuid": "993e2c90-34fc-4447-ac47-e994de4844da",
            "value": "cf555a9d6d1b98977aa82ec366860fae",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782101766",
            "to_ids": true,
            "type": "sha1",
            "uuid": "dee0df54-ce75-4477-89dd-5ce18d805339",
            "value": "ea8e3e2cab88e30e0eaadc23d4a66752f996ec48",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782101766",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c9692237-3275-4269-a563-26bfe29229d5",
            "value": "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782099737",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "3fedbbef-1c29-4424-b20b-de2046fa35b6",
            "value": "96:Q7TQThjT4TOqTfqTrzT3TWTU1TufoTwYM+GLKkRsiE76xSpTEjT2TlaFTHJTh1T5:/rIskgXJad"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782099737",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6f2cc4e8-65f9-4bc6-8213-7bc67b2d0b16",
            "value": "8480"
          },
          {
            "category": "Other",
            "comment": "Checked: 22/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782099737",
            "to_ids": false,
            "type": "text",
            "uuid": "982b048d-5c32-4fe0-90d9-e3ccc1c24cba",
            "value": "Type Description: Text\nMicrosoft: Trojan:Win32/Vigorf.A\nVT Total Detection:20/60\nFirst Submission:2026-06-11T21:48:43.000000+00:00\nLast Submission:2026-06-11T21:48:43.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782102415",
        "uuid": "6bb891e4-dd51-48f1-80c2-049979dbf6c1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782102415",
            "to_ids": true,
            "type": "md5",
            "uuid": "bcf7d3ee-697a-4909-81db-c68c42b2eda4",
            "value": "f2a430b3defdcaf7400f9d14abc864e3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782101767",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b996254b-4f47-448f-83bb-932fd6b9d5e9",
            "value": "96ed333e0cabbb6abd1902a381e7bdbf1358f414",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782101768",
            "to_ids": true,
            "type": "sha256",
            "uuid": "16c4aaa2-5a85-4ccf-b58a-6dd7a9fbf6b9",
            "value": "68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782099759",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f4215d77-cbed-49a7-b57a-f3f2bc1a2c13",
            "value": "98304:c/kSs+f7ldiWqE9EW+c39Pvi8KkhQ0LHyFkTpZ:c/kSsq7/iWqE9EW+IbKkVTSOZ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782099759",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "606318dd-814d-4ebd-a097-9d32681f6f38",
            "value": "3641436"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782099759",
            "to_ids": true,
            "type": "vhash",
            "uuid": "125fc9e7-d8eb-4d86-9e60-b1be8f70ee28",
            "value": "7e18cc9c9733776ae364c84a988f5e72"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782099759",
            "to_ids": true,
            "type": "filename",
            "uuid": "c74023b4-b2c9-42f9-94fc-8654ff0d021d",
            "value": "meshagent_x86"
          },
          {
            "category": "Other",
            "comment": "Checked: 22/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782099759",
            "to_ids": false,
            "type": "text",
            "uuid": "a0bdeb8d-8dab-43ea-8f1d-a0dd3578a918",
            "value": "Type Description: ELF\nMicrosoft: None\nVT Total Detection:2/63\nFirst Submission:2023-04-15T16:19:48.000000+00:00\nLast Submission:2026-06-11T21:48:55.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782102436",
        "uuid": "9aa0bcbc-12ec-4e85-bb6e-30acd7b23c31",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782102436",
            "to_ids": true,
            "type": "md5",
            "uuid": "64ad8d91-f0ec-42bb-934d-886a0797f229",
            "value": "87c75c0df3e1c32e64d4c9ea129fcff9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782101768",
            "to_ids": true,
            "type": "sha1",
            "uuid": "806e7ba2-60c1-4869-88a1-8181c4265597",
            "value": "1c4761fa03b4d5b61cd95f1dcc81ce326e7a6d9b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782101769",
            "to_ids": true,
            "type": "sha256",
            "uuid": "afc19d97-9a1b-4c9e-a900-0115d3f1e410",
            "value": "d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782099782",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9840907b-5387-4b9b-8397-bef12077410e",
            "value": "49152:0dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bUk:wHvfGfZvZj1/N/z/owJP"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782099782",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "31618c96-a25b-4974-aace-5508705f1768",
            "value": "3484272"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782099782",
            "to_ids": true,
            "type": "vhash",
            "uuid": "9360f682-5225-4892-865f-d1596437a271",
            "value": "036076656d556515655290100180f009c7z37z12z384z227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782099782",
            "to_ids": true,
            "type": "filename",
            "uuid": "7754c5a7-24ea-4c3c-b303-3c8e1025ac34",
            "value": "wlsnodemgr.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 22/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782099782",
            "to_ids": false,
            "type": "text",
            "uuid": "01b83468-b7c0-45a9-8ff6-8230496f6ce1",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:35/70\nFirst Submission:2026-05-28T02:15:10.000000+00:00\nLast Submission:2026-06-11T21:48:48.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782102457",
        "uuid": "055aa78e-3013-42dc-8eb9-f68e989b7476",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782102457",
            "to_ids": true,
            "type": "md5",
            "uuid": "8bc96278-8e8b-4224-8832-966ddf658254",
            "value": "b7af1868d3c5838c30d7d90521c7a721",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782101770",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6fd288a6-4a40-41e5-b93f-8222c8b57a5b",
            "value": "25011c7fb14b15e78f8a2a54606d37f7b753578a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782101770",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7ddd599f-e461-4e98-a73c-09f73780e584",
            "value": "f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782099804",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "afab418c-e1e1-4e05-a475-6603edec0488",
            "value": "49152:0dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bUe:wHvfGfZvZj1/N/z/owJV"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782099804",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "8c6836a3-0e7b-4d92-8dbe-290939467513",
            "value": "3484272"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782099804",
            "to_ids": true,
            "type": "vhash",
            "uuid": "6baf0714-e86f-4b09-906a-42df07f87b84",
            "value": "036076656d556515655290100180f009c7z37z12z384z227z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782099804",
            "to_ids": true,
            "type": "filename",
            "uuid": "bb9e73c1-42a8-4e62-b2ac-98788f534dac",
            "value": "0lniusdc.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 22/06/2026\nLast-scan\t:  18/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782099804",
            "to_ids": false,
            "type": "text",
            "uuid": "0977b7ae-d3b6-4901-b350-091153c57447",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:28/70\nFirst Submission:2026-06-11T21:48:45.000000+00:00\nLast Submission:2026-06-11T21:48:45.000000+00:00"
          }
        ]
      }
    ]
  }
}