{ "Event": { "analysis": "1", "date": "2026-07-08", "extends_uuid": "", "info": "[Threat Intel] Indonesian Banking Sector Threat Landscape", "protected": false, "publish_timestamp": "1784407979", "published": true, "threat_level_id": "3", "timestamp": "1784407978", "uuid": "7144c772-334d-49fc-b47c-76ef94780485", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#f9b12b", "local": false, "name": "misp-galaxy:producer=\"Cyfirma\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#4985d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#b672a4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task/Job - T1053\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#ad5a96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#2e58ce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#f9cdc4", "local": false, "name": "misp-galaxy:target-information=\"Indonesia\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#150050", "local": false, "name": "rectifyq:sub-category=\"report\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Bank\"", "relationship_type": "" }, { "colour": "#3500ca", "local": false, "name": "rectifyq:detection-rules=\"yara-from-src\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Cobalt Strike\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Havoc\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Icarus\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ValleyRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT41\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Amaranth-Dragon\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MUSTANG PANDA\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UNC6619\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783681224", "to_ids": false, "type": "link", "uuid": "364f0f70-83a7-4840-b6af-d737ae083cd2", "value": "https://www.cyfirma.com/research/indonesian-banking-sector-threat-landscape/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783681224", "to_ids": false, "type": "text", "uuid": "3ae789c8-c88b-4114-894d-e3f6bae34f7e", "value": "Indonesia's Banking, Financial Services, and Insurance sector faced significant cyber threats throughout 2026, including multiple alleged data breaches targeting major banking institutions and fintech platforms. Underground forums advertised compromised datasets containing customer information, account details, and sensitive documents, with varying levels of validation. Ransomware groups ICARUS and The Gentleman conducted extortion campaigns against financial organizations. China-linked APT groups including SilverFox, Mustang Panda, Amaranth-Dragon, Lotus Blossom, and Shadow Campaigns demonstrated sophisticated capabilities through phishing operations, supply chain compromises, and zero-day exploitation. These state-aligned actors deployed advanced malware such as ValleyRAT, ABCDoor, LOTUSLITE, and custom backdoors for long-term espionage. The expanding digital banking ecosystem and regional financial connectivity have increased attack surfaces, requiring enhanced cyber resilience, continuous monitoring, a..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783681224", "to_ids": false, "type": "text", "uuid": "54d5e419-70f1-4c02-8d1e-a6ff82cf53f8", "value": "Name: Indonesian Banking Sector Threat Landscape\nAuthor: AlienVault\nAdversary: SilverFox, Mustang Panda, Amaranth-Dragon, Lotus Blossom, Shadow Campaigns, TripleX, ICARUS, The Gen\nTags: [\"phishing campaigns\", \"apt espionage\", \"chrysalis\", \"financial cybercrime\", \"bfsi sector\", \"rustsl\", \"amaranth loader\", \"valleyrat\", \"lotuslite\", \"havoc\", \"data breach\", \"shadowguard\", \"abcdoor\", \"cve-2025-8088\", \"ransomware extortion\", \"tgamaranth rat\", \"cobalt strike\", \"indonesian banking\", \"supply chain compromise\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\", \"Indonesia\", \"Japan\", \"Russian Federation\", \"South Africa\", \"Thailand\"]\nMlwr families: [\"ValleyRAT\", \"ABCDoor\", \"LOTUSLITE\", \"Cobalt Strike - S0154\", \"Chrysalis\", \"TGAmaranth RAT\", \"Amaranth Loader\", \"Havoc\", \"ShadowGuard\", \"RustSL\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1539\", \"T1547\", \"T1204.002\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1071\", \"T1053\", \"T1140\", \"T1555\", \"T1059\", \"T1083\", \"T1204\", \"T1547.001\", \"T1566\", \"T1574\", \"T1027\", \"T1056\", \"T1071.001\", \"T1574.002\"]\nIndustries: [\"Finance\", \"Government\", \"Technology\", \"Telecommunications\", \"Insurance\", \"Transportation\", \"Aerospace\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783681224", "to_ids": false, "type": "threat-actor", "uuid": "94a99457-b926-42cd-a265-767fd837251f", "value": "SilverFox, Mustang Panda, Amaranth-Dragon, Lotus Blossom, Shadow Campaigns, TripleX, ICARUS, The Gen" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378567", "to_ids": true, "type": "domain", "uuid": "7fa07030-7d6e-496b-91be-95aa37b11a7e", "value": "emezonhe.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378588", "to_ids": true, "type": "ip-dst", "uuid": "be0253b2-6d04-478d-934b-53cd396d0724", "value": "188.127.251.171", "Tag": [ { "colour": "#57fb9f", "local": false, "name": "asn:asn=\"56694\"", "relationship_type": "" }, { "colour": "#3e3478", "local": false, "name": "asn:as-owner=\"SMARTAPE\"", "relationship_type": "" }, { "colour": "#fdd220", "local": false, "name": "asn:as-country=\"RU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378609", "to_ids": true, "type": "ip-dst", "uuid": "9a80881c-0815-417b-b745-18ff82a3fb02", "value": "59.110.7.32", "Tag": [ { "colour": "#5d39d0", "local": false, "name": "asn:asn=\"37963\"", "relationship_type": "" }, { "colour": "#76d941", "local": false, "name": "asn:as-owner=\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd.\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783681224", "to_ids": false, "type": "vulnerability", "uuid": "05c7d64b-12c1-4b84-bcfa-b559a7448b0b", "value": "CVE-2025-8088" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378630", "to_ids": true, "type": "domain", "uuid": "aac8ad4f-2ba7-48ba-99b3-350b8bfca2e7", "value": "skycloudcenter.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378651", "to_ids": true, "type": "domain", "uuid": "634eafa6-8517-4957-8a29-3316cd5e9d20", "value": "dog3rj.tech", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378673", "to_ids": true, "type": "domain", "uuid": "debd8a77-82a0-4dd5-8e68-347c9e92e397", "value": "q74vn.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378694", "to_ids": true, "type": "domain", "uuid": "3ae34ce0-46f7-4c35-8378-0fd13f0e6dfd", "value": "abwxjp5.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378715", "to_ids": true, "type": "domain", "uuid": "f9041bb8-e835-452c-8b61-f861a2438409", "value": "servgate.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378736", "to_ids": true, "type": "domain", "uuid": "750b3257-62d0-4c92-aa8d-40a354e41673", "value": "pr0fu5a.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378757", "to_ids": true, "type": "domain", "uuid": "008c55a8-a67d-4e68-96f5-dbdac414ae44", "value": "zamstats.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378779", "to_ids": true, "type": "domain", "uuid": "151e6979-7cbd-41a9-a6a0-4eabf3bba1ef", "value": "pickupweb.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378800", "to_ids": true, "type": "domain", "uuid": "71e7fbf5-f43c-42b9-a709-41caa64fe98b", "value": "zrheblirsy.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378821", "to_ids": true, "type": "domain", "uuid": "19a2dc98-9e83-4f96-a322-79e5a7273832", "value": "msonline.help", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378842", "to_ids": true, "type": "domain", "uuid": "e35eb36c-c312-4cea-b413-3412ff459c16", "value": "gouvn.me", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378863", "to_ids": true, "type": "hostname", "uuid": "44b94908-2fa3-4c38-bcc8-4b6418d65939", "value": "abc.doublemobile.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378884", "to_ids": true, "type": "hostname", "uuid": "c571e46e-5728-48e4-98e7-3590a91409e1", "value": "editor.gleeze.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378905", "to_ids": true, "type": "hostname", "uuid": "ad39f067-b875-4e10-ae46-1ef6df9f3318", "value": "www.cosmosmusic.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378926", "to_ids": true, "type": "domain", "uuid": "7aa5f000-d72a-4cc0-9b3f-95726d717400", "value": "mcagov.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378948", "to_ids": true, "type": "domain", "uuid": "fbeda857-d3c0-40f1-80e0-99de42e859c8", "value": "roldco.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378969", "to_ids": true, "type": "hostname", "uuid": "4114c39a-945c-4b71-abfa-94bc3500cc43", "value": "abc.3mkorealtd.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378990", "to_ids": true, "type": "hostname", "uuid": "0d0ff1ba-b734-4629-9e4d-d4573ec0b545", "value": "abc.fetish-friends.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379011", "to_ids": true, "type": "hostname", "uuid": "5c93daa8-3436-43fb-b98e-e4c2812b6faa", "value": "abc.haijing88.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379032", "to_ids": true, "type": "hostname", "uuid": "4483132c-d694-4463-b31f-6a879b39fe29", "value": "abc.ilptour.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379053", "to_ids": true, "type": "hostname", "uuid": "9345a706-4f9e-41c5-a5b5-c3c2920c2ced", "value": "abc.petitechanson.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379074", "to_ids": true, "type": "hostname", "uuid": "10a52613-1c5f-40a9-ad68-f35f1385c9a7", "value": "abc.sudsmama.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379096", "to_ids": true, "type": "hostname", "uuid": "db9ad4ad-9837-4138-a5ce-66ab3b4c2177", "value": "abc.woopami.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379117", "to_ids": true, "type": "hostname", "uuid": "19ee12a5-0b62-49bc-b7b7-640c64bd3be1", "value": "vnc.kcii2.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784407971", "to_ids": true, "type": "sha1", "uuid": "5f3bcd3e-731a-4ac9-848f-384e6e031279", "value": "09b0bc41f8838949d5a1c442ee2e2ec9ff892fdc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784407974", "to_ids": true, "type": "sha1", "uuid": "c1bce09e-5648-4245-bab0-0f648acf8f08", "value": "a12db7b72879ac0f46079efd8c67e8ca0621f73b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784407976", "to_ids": true, "type": "sha1", "uuid": "361972e4-b7a2-430d-8eb2-d279b74d876e", "value": "cc6fd90785a528883b0203138348df8bad69bb1a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784407978", "to_ids": true, "type": "sha1", "uuid": "149b3600-a07c-45ba-b469-e8295cd3116b", "value": "f0b182423107a04cf5f09b8559e656242a4fcc89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784379139", "to_ids": true, "type": "domain", "uuid": "7f6c3930-7748-4d9d-a5a3-9328a7e2b5e8", "value": "gpsfinance.co.id", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1784364848", "uuid": "435cba40-e964-4cb1-bfc1-f73cac0db59c", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1784364848", "to_ids": false, "type": "text", "uuid": "8c199904-b11f-4bb1-8b41-3a3c576bcc25", "value": "SilverFox_HighConfidence_2026" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1784364848", "to_ids": false, "type": "comment", "uuid": "3dba67e2-04b4-4696-8516-d1417518f56c", "value": "High-confidence SilverFox infrastructure detection" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1784364848", "to_ids": true, "type": "yara", "uuid": "3fdbbe67-ada1-46a9-a9fd-8921e7488a4c", "value": "rule SilverFox_HighConfidence_2026\r\n{\r\nmeta:\r\ndescription = \u201cHigh-confidence SilverFox infrastructure detection\u201d\r\nthreat_actor = \u201cSilverFox\u201d\r\n\r\nstrings:\r\n$a1 = \u201cabc.fetish-friends.com\u201d ascii wide\r\n$a2 = \u201cabc.3mkorealtd.com\u201d ascii wide\r\n$a3 = \u201cabc.sudsmama.com\u201d ascii wide\r\n$a4 = \u201cabc.woopami.com\u201d ascii wide\r\n$a5 = \u201cabc.ilptour.com\u201d ascii wide\r\n$a6 = \u201cabc.petitechanson.com\u201d ascii wide\r\n$a7 = \u201cabc.doublemobile.com\u201d ascii wide\r\n$b1 = \u201cmcagov.cc\u201d ascii wide\r\n$b2 = \u201croldco.com\u201d ascii wide\r\n$b3 = \u201cabc.haijing88.com\u201d ascii wide\r\n$b4 = \u201cvnc.kcii2.com\u201d ascii wide\r\ncondition:\r\n2 of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1784364873", "uuid": "5470c27d-b4bc-4c42-af32-3e5ea809bee1", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1784364873", "to_ids": false, "type": "text", "uuid": "275b18e7-fd24-44a5-8d95-77ef0a477caa", "value": "CYFIRMA_APT_LotusBlossom_NotepadPP_SupplyChain" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1784364873", "to_ids": false, "type": "comment", "uuid": "64e524fb-3b84-4db1-ae79-d0692d349870", "value": "Detects Lotus Blossom (Spring Dragon/Billbug) Notepad++ supply chain campaign based on embedded infrastructure indicators" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1784364873", "to_ids": true, "type": "yara", "uuid": "089eb406-0f07-43d1-b9f9-b682ecd4a5f6", "value": "rule CYFIRMA_APT_LotusBlossom_NotepadPP_SupplyChain\r\n{\r\nmeta:\r\ndescription = \u201cDetects Lotus Blossom (Spring Dragon/Billbug) Notepad++ supply chain campaign based on embedded infrastructure indicators\u201d\r\nauthor = \u201cCYFIRMA\u201d\r\nthreat_actor = \u201cLotus Blossom (Spring Dragon/Billbug)\u201d\r\nstrings:\r\n/* Domains */\r\n$d1 = \u201cskycloudcenter.com\u201d ascii nocase\r\n$d2 = \u201cself-dns.it.com\u201d ascii nocase\r\n$d3 = \u201csafe-dns.it.com\u201d ascii nocase\r\n$d4 = \u201ccdncheck.it.com\u201d ascii nocase\r\n/* URLs */\r\n$u1 = \u201c/update/AutoUpdater.exe\u201d ascii\r\n$u2 = \u201c/update/Upgrade.exe\u201d ascii\r\n$u3 = \u201c/update/update.exe\u201d ascii\r\n$u4 = \u201c/dpixel\u201d ascii\r\n$u5 = \u201c/help/Get-Start\u201d ascii\r\n$u6 = \u201c/resolve\u201d ascii\r\n$u7 = \u201c/dns-query\u201d ascii\r\n/* IP Addresses */\r\n$ip1 = \u201c95.179.213.0\u201d ascii\r\n$ip2 = \u201c45.76.155.202\u201d ascii\r\n$ip3 = \u201c45.77.31.210\u201d ascii\r\n$ip4 = \u201c45.32.144.255\u201d ascii\r\n$ip5 = \u201c61.4.102.97\u201d ascii\r\n$ip6 = \u201c59.110.7.32\u201d ascii\r\ncondition:\r\n(2 of ($d*)) or\r\n(2 of ($ip*)) or\r\n(2 of ($u*)) or\r\n(1 of ($d*) and 1 of ($ip*)) or\r\n(1 of ($d*) and 1 of ($u*)) or\r\n(1 of ($ip*) and 1 of ($u*))\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1784364892", "uuid": "08f822d8-3614-47ee-878b-23d4a8497870", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1784364892", "to_ids": false, "type": "text", "uuid": "6f0e3bbf-1b07-4532-9717-5a76a7922332", "value": "MustangPanda_LOTUSLITE_HighConfidence" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1784364892", "to_ids": false, "type": "comment", "uuid": "2a731c2a-c688-4974-80b0-ac9f0fc8ff4d", "value": "High-confidence Mustang Panda LOTUSLITE detection" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1784364892", "to_ids": true, "type": "yara", "uuid": "361c1804-6b26-43d4-a263-f84360beddf2", "value": "rule MustangPanda_LOTUSLITE_HighConfidence\r\n{\r\nmeta:\r\ndescription = \u201cHigh-confidence Mustang Panda LOTUSLITE detection\u201d\r\nthreat_actor = \u201cMustang Panda\u201d\r\nstrings:\r\n$d1 = \u201ceditor.gleeze.com\u201d ascii wide\r\n$d2 = \u201cwww.cosmosmusic.com\u201d ascii wide\r\n$m1 = \u201cmdseccoUkFuiCkTrump\u201d ascii wide\r\n$m2 = \u201c1ac5e7ee1a107499\u201d ascii wide\r\n$p1 = \u201cC:\\\\ProgramData\\\\Microsoft_DNX\\\\\u201d ascii wide\r\ncondition:\r\n2 of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1784364910", "uuid": "6f44997c-64c3-4867-87d1-75779e32f865", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1784364910", "to_ids": false, "type": "text", "uuid": "2ce6eb5b-7de9-40d5-b92f-7e44e8be1798", "value": "WinntiLinux_Dropper" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1784364910", "to_ids": true, "type": "yara", "uuid": "bd5cbf99-0c9a-469e-8e83-3551a72f9aea", "value": "rule WinntiLinux_Dropper\r\n{\r\nsha256 = \u201c4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a\u201d\r\nstrings:\r\n$config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }\r\n$export1 = \u201cour_sockets\u201d\r\n$export2 = \u201cget_our_pids\u201d\r\ncondition:\r\nuint16(0) == 0x457f and all of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1784364930", "uuid": "4e3d3837-5965-44ca-ad31-f2d022ac4d99", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1784364930", "to_ids": false, "type": "text", "uuid": "18e0a2c6-af2e-401f-a23b-b2dbe07595a1", "value": "CYFIRMA_APT_UNC6619_ShadowCampaigns_Indicators" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1784364930", "to_ids": false, "type": "comment", "uuid": "dc351ae9-c511-4386-8310-f6d4df9f512f", "value": "Detects UNC6619 (Shadow Campaigns / TGR-STA-1030) malware based on embedded infrastructure indicators" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1784364930", "to_ids": true, "type": "yara", "uuid": "fa2abec9-a729-4f52-b073-927e7f4e703a", "value": "rule CYFIRMA_APT_UNC6619_ShadowCampaigns_Indicators\r\n{\r\nmeta:\r\ndescription = \u201cDetects UNC6619 (Shadow Campaigns / TGR-STA-1030) malware based on embedded infrastructure indicators\u201d\r\nauthor = \u201cCYFIRMA\u201d\r\nthreat_actor = \u201cUNC6619 / Shadow Campaigns / TGR-STA-1030\u201d\r\nmalware_family = \u201cCobalt Strike, ShadowGuard\u201d\r\nstrings:\r\n/* Domains */\r\n$d1 = \u201cabwxjp5.me\u201d ascii nocase\r\n$d2 = \u201cbrackusi0n.live\u201d ascii nocase\r\n$d3 = \u201cdog3rj.tech\u201d ascii nocase\r\n$d4 = \u201cemezonhe.me\u201d ascii nocase\r\n$d5 = \u201cgouvn.me\u201d ascii nocase\r\n$d6 = \u201cmsonline.help\u201d ascii nocase\r\n$d7 = \u201cpickupweb.me\u201d ascii nocase\r\n$d8 = \u201cpr0fu5a.me\u201d ascii nocase\r\n$d9 = \u201cq74vn.live\u201d ascii nocase\r\n$d10 = \u201cservgate.me\u201d ascii nocase\r\n$d11 = \u201czamstats.me\u201d ascii nocase\r\n$d12 = \u201czrheblirsy.me\u201d ascii nocase\r\n/* IP Addresses */\r\n$ip1 = \u201c138.197.44.208\u201d ascii\r\n$ip2 = \u201c142.91.105.172\u201d ascii\r\n$ip3 = \u201c146.190.152.219\u201d ascii\r\n$ip4 = \u201c157.230.34.45\u201d ascii\r\n$ip5 = \u201c157.245.194.54\u201d ascii\r\n$ip6 = \u201c159.65.156.200\u201d ascii\r\n$ip7 = \u201c159.203.164.101\u201d ascii\r\n$ip8 = \u201c178.128.60.22\u201d ascii\r\n$ip9 = \u201c178.128.109.37\u201d ascii\r\n$ip10 = \u201c188.127.251.171\u201d ascii\r\n$ip11 = \u201c188.166.210.146\u201d ascii\r\n$ip12 = \u201c208.85.21.30\u201d ascii\r\ncondition:\r\n2 of ($d*) or\r\n2 of ($ip*) or\r\n(1 of ($d*) and 1 of ($ip*))\r\n}" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784407969", "uuid": "762bb829-d72f-4155-ad93-56b905b2ba15", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "md5", "timestamp": "1784407968", "to_ids": true, "type": "md5", "uuid": "f8b8d15b-2261-4685-b19d-04fc841ead28", "value": "11a9f798227be8a53b06d7e8943f8d68", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "sha1", "timestamp": "1784407968", "to_ids": true, "type": "sha1", "uuid": "18218fae-2289-4c4e-9a0a-cc58bc1a98d9", "value": "906dc86cb466c1a22cf847dda27a434d04adf065", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "sha256", "timestamp": "1784407969", "to_ids": true, "type": "sha256", "uuid": "33e815ac-7ba0-40a3-8131-e7eab22b38a9", "value": "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "text", "timestamp": "1784366929", "to_ids": false, "type": "text", "uuid": "e8ee60fd-1296-43f1-8443-ca1ae3760e6c", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Winnti.B!dha\nClamAV: Unix.Trojan.Winnti-6975334-0\nVT Total Detection: 39/74\nFirst Seen In The Wild: 2019-03-15T12:35:37+00:00\nFirst Submission: 2017-08-26T05:24:08+00:00\nLast Submission: 2024-06-19T01:46:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "ssdeep", "timestamp": "1784366929", "to_ids": true, "type": "ssdeep", "uuid": "3d528f14-8ddc-420c-8da0-76fe0ccd28da", "value": "384:2jFYRGxG0YWaycrMORgnQ9MXTShjqDSk8YKoA4LnpkTcc2ohNA0y:2iRGgLLyctkCoAyDc2EA0y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1784366929", "to_ids": false, "type": "size-in-bytes", "uuid": "ca9216a6-87e0-4847-bb96-d43467e06c8f", "value": "24512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "vhash", "timestamp": "1784366929", "to_ids": true, "type": "vhash", "uuid": "ac5aa441-ff66-4a0b-9396-d2f466f85777", "value": "f4bdcee8548613727934d703e439f0cb" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2017-08-26T05:24:08+00:00", "last_seen": "2024-06-19T01:46:46+00:00", "object_relation": "filename", "timestamp": "1784366929", "to_ids": true, "type": "filename", "uuid": "6a6a170b-2507-43b7-b668-7f60e9849073", "value": "VirusShare_11a9f798227be8a53b06d7e8943f8d68" } ] } ] } }