{ "Event": { "analysis": "1", "date": "2026-07-23", "extends_uuid": "", "info": "[Threat Intel] Zimbra Mailservers Targeted with Half-Click Exploits", "protected": false, "publish_timestamp": "1785586365", "published": true, "threat_level_id": "1", "timestamp": "1785586364", "uuid": "83d38377-3431-4353-acbd-43ceb8cf9eb4", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#2d8ee7", "local": false, "name": "misp-galaxy:producer=\"Proofpoint\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#bb2745", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#110e53", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#f6f176", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Account - T1087.003\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#cfba47", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": "" }, { "colour": "#f95f85", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#83203e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Account - T1136.003\"", "relationship_type": "" }, { "colour": "#71ecdb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#23cf0e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"", "relationship_type": "" }, { "colour": "#0aebeb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"", "relationship_type": "" }, { "colour": "#0add7f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#e4d611", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#150052", "local": false, "name": "rectifyq:sub-category=\"zero-day\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#3500ca", "local": false, "name": "rectifyq:detection-rules=\"yara-from-src\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Zebrocy\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT28\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Ghostwriter\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UAC-0063\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862026", "to_ids": false, "type": "link", "uuid": "dd29bfb0-dac8-4869-a45a-e75784d83953", "value": "https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784862026", "to_ids": false, "type": "text", "uuid": "10a35273-0b47-4dbd-b9a6-8748493f03a7", "value": "Russian-aligned threat actor TA488, also known as Void Blizzard and Laundry Bear, exploited a previously unknown vulnerability in Zimbra Collaboration Suite mailservers for at least five months during 2025. The vulnerability, later assigned CVE-2025-66376, was leveraged through half-click exploits embedded in HTML emails that executed upon opening without requiring user interaction. Upon successful exploitation, TA488 deployed ZimReaper malware to establish persistent access, steal credentials and two-factor authentication codes, and exfiltrate emails via DNS tunneling and HTTP requests. The campaigns primarily targeted Ukrainian government entities, alongside U.S. government, nuclear science facilities, and defense industrial base organizations. The actor used domains spoofing Zimbra telemetry services and regularly updated obfuscation techniques to evade detection. TA488 is believed to be a private contractor working for Russian intelligence services." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784862027", "to_ids": false, "type": "text", "uuid": "8aa8f779-f61f-4d16-b157-95aa09707f63", "value": "Name: Zimbra Mailservers Targeted with Half-Click Exploits\nAuthor: AlienVault\nAdversary: TA488\nTags: [\"xss vulnerability\", \"laundry bear\", \"credential theft\", \"zimbra\", \"dns tunneling\", \"cve-2025-66376\", \"ta488\", \"zimreaper\", \"russian intelligence\", \"void blizzard\", \"half-click exploits\"]\nTgtd countries: [\"United States of America\", \"Ukraine\"]\nMlwr families: [\"ZimReaper\"]\nAttack_ids: [\"T1132.001\", \"T1059.007\", \"T1133\", \"T1539\", \"T1071.004\", \"T1566.001\", \"T1106\", \"T1190\", \"T1087.003\", \"T1555.003\", \"T1020\", \"T1552.001\", \"T1041\", \"T1136.003\", \"T1098\", \"T1078\", \"T1114.002\", \"T1203\", \"T1567.002\", \"T1048.003\"]\nIndustries: [\"Government\", \"Defense\", \"Energy\", \"Education\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784862027", "to_ids": false, "type": "threat-actor", "uuid": "99ef0965-7022-4b32-936f-a9d9c86d837a", "value": "TA488" }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579059", "to_ids": true, "type": "domain", "uuid": "58ae3f32-5d76-48d1-a786-6a62c66c7be7", "value": "zimbra-metadata.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579080", "to_ids": true, "type": "domain", "uuid": "965806b4-9294-4b20-8caf-b6af63d9676c", "value": "emailanalytics.com.ua", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579102", "to_ids": true, "type": "domain", "uuid": "bee7d8c1-5341-439b-a2ad-17a5293f531a", "value": "mailnalysis.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579123", "to_ids": true, "type": "domain", "uuid": "6abbe405-42bf-433f-9964-cc59354281a0", "value": "analyticemailmeter.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579144", "to_ids": true, "type": "domain", "uuid": "4235dcb3-7502-40b7-b99d-238621826261", "value": "zimbrastat.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579165", "to_ids": true, "type": "domain", "uuid": "83e75fda-7d81-4945-b26e-e5cf22091c00", "value": "zimbrasoft.com.ua", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862027", "to_ids": false, "type": "vulnerability", "uuid": "37b32272-bbb5-4574-a97d-9be991f6842d", "value": "CVE-2025-66376" }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579188", "to_ids": true, "type": "domain", "uuid": "d1aff3a4-92bc-476b-b88e-9f01cbf0b8ef", "value": "istc-cloud.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579209", "to_ids": true, "type": "domain", "uuid": "f6460ca0-c170-441a-9228-a2eb2b2c1594", "value": "synacorzimbra.nl", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ZimReaper C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785579230", "to_ids": true, "type": "domain", "uuid": "5d904ded-44bd-4ea6-bfbf-9c8838efd904", "value": "zmailanalytics.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Actor-controlled sender address", "deleted": false, "disable_correlation": false, "timestamp": "1785190876", "to_ids": true, "type": "email-src", "uuid": "1af26a63-a275-4180-888e-fa960c93e389", "value": "c.laurent.ejfa@proton.me" }, { "category": "Payload delivery", "comment": "Actor-controlled sender address", "deleted": false, "disable_correlation": false, "timestamp": "1785190886", "to_ids": true, "type": "email-src", "uuid": "a122cdfb-b569-40b1-8fcb-48bfbee03774", "value": "j.moreau.epsc@proton.me" }, { "category": "Payload delivery", "comment": "Actor-controlled sender address", "deleted": false, "disable_correlation": false, "timestamp": "1785190887", "to_ids": true, "type": "email-src", "uuid": "f1059a8d-0ee4-4387-b733-75812c614198", "value": "liberty.insights@proton.me" } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1785190979", "uuid": "43010863-c440-4ece-bf9e-ab8f02c4f989", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1785190979", "to_ids": false, "type": "text", "uuid": "71435f63-53ef-47c9-9bd9-1e765dbded15", "value": "TA488_Zimbra_Exploit_Email" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1785190979", "to_ids": false, "type": "comment", "uuid": "1a308c4d-05e0-438d-9ddb-add203d1666c", "value": "Track TA488 emails using Zimbra exploits" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1785190979", "to_ids": true, "type": "yara", "uuid": "3f798cde-8545-47d4-b4bf-0f7bd25cc2a4", "value": "rule TA488_Zimbra_Exploit_Email\r\n{\r\n\u2003\u2003meta:\r\n\u2003\u2003\u2003\u2003author = \"Greg Lesnewich\"\r\n\u2003\u2003\u2003\u2003description = \"Track TA488 emails using Zimbra exploits\"\r\n\u2003\u2003\u2003\u2003date = \"2026-01-15\"\r\n\u2003\u2003\u2003\u2003version = \"1.0\"\r\n\u2003\u2003\u2003\u2003hash = \"98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf\"\r\n\u2003\u2003\u2003\u2003hash = \"60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874\"\r\n\u2003\u2003\u2003\u2003hash = \"b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d\"\r\n\u2003\u2003\u2003\u2003hash = \"1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760\"\r\n\u2003\u2003strings:\r\n\u2003\u2003\u2003\u2003$ = /<\\w+@import;/ \r\n\u2003\u2003\u2003\u2003$ = \"ID0gInptYl9wbF\" ascii base64 \r\n\u2003\u2003\u2003\u2003$ = \"A9ICJ6bWJfcGxf\" ascii base64 \r\n\u2003\u2003\u2003\u2003$ = \"gPSAiem1iX3BsX\" ascii base64 \r\n\u2003\u2003\u2003\u2003$ = \"em1iX3BsX\" ascii base64 \r\n\u2003\u2003\u2003\u2003$ = \"ptYl9wbF\" ascii base64 \r\n\u2003\u2003\u2003\u2003$ = \"6bWJfcGxf\" ascii base64 \r\n\u2003\u2003\u2003\u2003$ = \" = \\\"zmb_pl_\" ascii base64 \r\n\u2003\u2003\u2003\u2003$ = \"zmb_pl_\" ascii base64 \r\n\u2003\u2003condition:\r\n\u2003\u2003\u2003\u20031 of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785579251", "uuid": "39333f99-f469-40c0-9dac-78a824667caf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "object_relation": "md5", "timestamp": "1785579251", "to_ids": true, "type": "md5", "uuid": "461c5ad6-2477-4c24-8284-49f7f053bd88", "value": "c010f64080b0b0997b362a8e6b9c618e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "object_relation": "sha1", "timestamp": "1785578904", "to_ids": true, "type": "sha1", "uuid": "cec08c18-055e-42d2-b9f3-4d3e19ba807a", "value": "e3ce7d13a83716594787a12edf6cbeedc76b9a65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "object_relation": "sha256", "timestamp": "1785578904", "to_ids": true, "type": "sha256", "uuid": "7c494c4f-37cb-4c39-94a7-7cefe58c3cac", "value": "98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "object_relation": "text", "timestamp": "1785577619", "to_ids": false, "type": "text", "uuid": "cd1c04ca-b2b2-48bd-9037-75c7b8cc45dd", "value": "Type Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 18/75\nFirst Seen In The Wild: 2026-02-26T10:52:57+00:00\nFirst Submission: 2026-02-26T06:42:55+00:00\nLast Submission: 2026-02-26T06:42:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "object_relation": "ssdeep", "timestamp": "1785577619", "to_ids": true, "type": "ssdeep", "uuid": "c4f3d052-3cc2-4dfa-84c6-95e7372e6730", "value": "384:XZb7Gmo4BsvAr6Ygkx8lPr7VQVdPVpfMmBhLunvXkS90vmAR0ytNH:J+moi9KkeTRQLDNekS90OAa2NH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577619", "to_ids": false, "type": "size-in-bytes", "uuid": "74fdc946-5813-4850-b56b-114b57f66dec", "value": "22731" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T06:42:55+00:00", "last_seen": "2026-02-26T06:42:55+00:00", "object_relation": "filename", "timestamp": "1785577619", "to_ids": true, "type": "filename", "uuid": "c2898790-994b-4693-91d0-84b0f81635d5", "value": "belinskyi.v@hydro.gov.ua_22.01.2026.txt" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-05T13:23:33+00:00", "last_seen": "2025-11-05T13:23:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785579272", "uuid": "77650ad9-3fc0-47dc-8c70-d5568242b52c", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-05T13:23:33+00:00", "last_seen": "2025-11-05T13:23:33+00:00", "object_relation": "md5", "timestamp": "1785579272", "to_ids": true, "type": "md5", "uuid": "5f87b7db-86dc-4d85-be4e-46e2443ef841", "value": "99907f75753418d81291a3f358c67a95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-05T13:23:33+00:00", "last_seen": "2025-11-05T13:23:33+00:00", "object_relation": "sha1", "timestamp": "1785578905", "to_ids": true, "type": "sha1", "uuid": "76109cb1-73ee-4c37-8a1d-8ff0fe83982c", "value": "001daab9e9072d5db0613df77a2ff6752d0e672a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-05T13:23:33+00:00", "last_seen": "2025-11-05T13:23:33+00:00", "object_relation": "sha256", "timestamp": "1785578905", "to_ids": true, "type": "sha256", "uuid": "dae9916e-e608-4e45-a38d-03b0b20d8d9b", "value": "1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-05T13:23:33+00:00", "last_seen": "2025-11-05T13:23:33+00:00", "object_relation": "text", "timestamp": "1785577641", "to_ids": false, "type": "text", "uuid": "f86c5e58-c9f5-4383-828e-fa2cee9ca594", "value": "Exploit email\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 18/75\nFirst Submission: 2025-11-05T13:23:33+00:00\nLast Submission: 2025-11-05T13:23:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-05T13:23:33+00:00", "last_seen": "2025-11-05T13:23:33+00:00", "object_relation": "ssdeep", "timestamp": "1785577641", "to_ids": true, "type": "ssdeep", "uuid": "f37bf7fa-5feb-4817-a246-82e352b2a092", "value": "384:dye89rgyGIPwXDIT6XZ5KD3rEQWxMso0A:dyeo869rEQWxMsvA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-05T13:23:33+00:00", "last_seen": "2025-11-05T13:23:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577641", "to_ids": false, "type": "size-in-bytes", "uuid": "81bb445a-aafc-4196-82f0-e2d3f3bc1e84", "value": "18582" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785579293", "uuid": "88392c1d-591d-456e-b275-9a2027318605", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "object_relation": "md5", "timestamp": "1785579293", "to_ids": true, "type": "md5", "uuid": "2c3aeb51-0d5e-41f7-b60f-cc7dc21523a3", "value": "2b06405f32eff7b00d81f2d61577bfd8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "object_relation": "sha1", "timestamp": "1785578906", "to_ids": true, "type": "sha1", "uuid": "b7f8cb97-8f56-49d8-a6a5-ea7f7ef824c4", "value": "aafcd362fe49dc9045c346aaaecaf4fe730cc3b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "object_relation": "sha256", "timestamp": "1785578906", "to_ids": true, "type": "sha256", "uuid": "8f52d565-f306-4f30-a532-d2c058fd03c2", "value": "60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "object_relation": "text", "timestamp": "1785577663", "to_ids": false, "type": "text", "uuid": "49dcff76-6c7f-499e-801a-7227c1d9cb2e", "value": "Exploit email\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/75\nFirst Seen In The Wild: 2026-07-20T19:47:03+00:00\nFirst Submission: 2025-12-16T19:40:11+00:00\nLast Submission: 2025-12-16T19:40:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "object_relation": "ssdeep", "timestamp": "1785577663", "to_ids": true, "type": "ssdeep", "uuid": "036c4527-f2a1-49f5-9b5d-5dd43d0f5b65", "value": "768:ztFmn8BMCEF+Q618XpjdqbgXo8n8Pyet55Qe8+Hs61n/+xa6FpsLIHL9WM6:ztFmn/+Q61oxh8aa5Q3Ks0nrAg/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577663", "to_ids": false, "type": "size-in-bytes", "uuid": "06eb12b8-fa94-4963-b801-9023ac777061", "value": "36572" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-16T19:40:11+00:00", "last_seen": "2025-12-16T19:40:11+00:00", "object_relation": "filename", "timestamp": "1785577663", "to_ids": true, "type": "filename", "uuid": "511e4261-fe38-45e4-bedc-a2666c258fcb", "value": "01.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785579314", "uuid": "e4c587c0-caee-44d5-ad65-05dc91bdeb1b", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "object_relation": "md5", "timestamp": "1785579314", "to_ids": true, "type": "md5", "uuid": "08399021-d628-43e0-94f9-d5da3cf13408", "value": "546208e57f9f5d52bb3a41d04b75c68e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "object_relation": "sha1", "timestamp": "1785578907", "to_ids": true, "type": "sha1", "uuid": "2607dfd3-aabf-45cb-8da7-2f12feacabcd", "value": "314e26a75c4a80eff14d72e391503634480368e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit email", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "object_relation": "sha256", "timestamp": "1785578907", "to_ids": true, "type": "sha256", "uuid": "f91c4372-3a24-40a2-ba19-92e6e5a8fe24", "value": "b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "object_relation": "text", "timestamp": "1785577684", "to_ids": false, "type": "text", "uuid": "118e21c1-2730-4844-b06d-9e61eef5b466", "value": "Exploit email\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 7/75\nFirst Submission: 2025-12-02T09:21:04+00:00\nLast Submission: 2025-12-03T12:40:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "object_relation": "ssdeep", "timestamp": "1785577684", "to_ids": true, "type": "ssdeep", "uuid": "5025b49b-e9de-44bb-bf52-4c3b4a8f2e37", "value": "384:UhJWrFCF0xBT5oYOHlewBhxlLPzeHDFOb5FxPyaiAtSpAIUW7ZsRTVP2YkIk:LBTGYOH0OxlLbejAbQCSRUAyTO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577684", "to_ids": false, "type": "size-in-bytes", "uuid": "349c1aea-1a15-4c6c-bac5-a05eb9703436", "value": "20653" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-02T09:21:04+00:00", "last_seen": "2025-12-03T12:40:26+00:00", "object_relation": "filename", "timestamp": "1785577684", "to_ids": true, "type": "filename", "uuid": "dcdbd2e2-35ed-4cef-bff9-24413b3baadf", "value": "CERT_20_11_2025.eml" } ] } ] } }