{
  "Event": {
    "analysis": "1",
    "date": "2026-07-28",
    "extends_uuid": "",
    "info": "[Threat Intel] Mirage Kitten targets Middle East and Africa region with new malware",
    "protected": false,
    "publish_timestamp": "1785643422",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785643421",
    "uuid": "99ef570f-f513-4de6-bebd-c813ecc5fe87",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Kaspersky\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#256f6a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DLL - T1574.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#f07d7c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#08b028",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e12cbc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#c295b4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#affa6e",
        "local": false,
        "name": "misp-galaxy:target-information=\"Burkina Faso\"",
        "relationship_type": ""
      },
      {
        "colour": "#78cd12",
        "local": false,
        "name": "misp-galaxy:target-information=\"Egypt\"",
        "relationship_type": ""
      },
      {
        "colour": "#997689",
        "local": false,
        "name": "misp-galaxy:target-information=\"Ethiopia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Jordan\"",
        "relationship_type": ""
      },
      {
        "colour": "#670cf4",
        "local": false,
        "name": "misp-galaxy:target-information=\"Pakistan\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Tanzania\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"LIGHTRAIL\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785294006",
        "to_ids": false,
        "type": "link",
        "uuid": "8d3411ef-1e1f-4e6d-81b5-b1abea87032e",
        "value": "https://securelist.com/mirage-kitten-new-tools/120811/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785294006",
        "to_ids": false,
        "type": "text",
        "uuid": "c1ee06fa-b0f3-472d-ac28-24839fd1fa94",
        "value": "Mirage Kitten, an advanced persistent threat group also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, has been observed deploying a previously undocumented malware set targeting aerospace, aviation, defense, and telecommunications sectors across the Middle East and Africa. The toolset includes NightLedger, a Windows backdoor with reconnaissance, command execution, file operations, process discovery, and screenshot capture capabilities. Two custom WebSocket-based tunneling tools, ArcBridge and BridgeHead, enable covert network access and operator-controlled tunneling through victim networks. The group employs highly targeted spear-phishing campaigns, fake recruitment portals, and lookalike videoconferencing pages. Victims were identified in Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso. The malware demonstrates operational security through username-based execution checks and advanced proxy traversal capabilities."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785294006",
        "to_ids": false,
        "type": "text",
        "uuid": "64bfb2bb-f7fd-4737-af5f-17867c1e0681",
        "value": "Name: Mirage Kitten targets Middle East and Africa region with new malware\nAuthor: AlienVault\nAdversary: Mirage Kitten\nTags: [\"mirage kitten\", \"retrograde\", \"arcbridge\", \"backdoor\", \"twostroke\", \"pollblend\", \"bridgehead\", \"africa\", \"middle east\", \"miniupdate\", \"minifast\", \"websocket tunneler\", \"cyber-espionage\", \"lightrail\", \"spear-phishing\", \"nightledger\"]\nTgtd countries: [\"Burkina Faso\", \"Egypt\", \"Ethiopia\", \"Jordan\", \"Pakistan\", \"Tanzania, United Republic of\"]\nMlwr families: [\"NightLedger\", \"BridgeHead\", \"ArcBridge\", \"TWOSTROKE\", \"Retrograde\", \"MiniFast\", \"MiniUpdate\", \"LIGHTRAIL\", \"POLLBLEND\"]\nAttack_ids: [\"T1113\", \"T1056.001\", \"T1204.002\", \"T1566.001\", \"T1574.001\", \"T1082\", \"T1140\", \"T1083\", \"T1057\", \"T1041\", \"T1547.001\", \"T1090.003\", \"T1571\", \"T1027\", \"T1573.002\", \"T1095\", \"T1070.004\", \"T1071.001\", \"T1105\", \"T1090.001\"]\nIndustries: [\"Aerospace\", \"Defense\", \"Telecommunications\", \"Government\", \"Finance\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785621219",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "e3549f5e-7531-4d5d-84e6-5a3ee92b0dc5",
        "value": "Mirage Kitten",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:producer=\"Kaspersky\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785294006",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "bfae4228-4592-48b5-b61a-b15c4665c909",
        "value": "CVE-2019-0859"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785294006",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "83f5c02c-e061-496a-b8bc-76ee90f4e73d",
        "value": "CVE-2019-0797"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633591",
        "to_ids": true,
        "type": "domain",
        "uuid": "7c445ec7-6364-4fde-ab97-221f0c60eeab",
        "value": "neexportfolio.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633612",
        "to_ids": true,
        "type": "domain",
        "uuid": "a932919c-6584-40e1-8b5f-c044f94520b1",
        "value": "buisness-centeral-transportation.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633634",
        "to_ids": true,
        "type": "domain",
        "uuid": "ef7e919e-fbb6-4e8a-a878-c46a945c7f55",
        "value": "healthcarezoomcenteral.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633655",
        "to_ids": true,
        "type": "domain",
        "uuid": "fcba200b-94ad-45c2-9197-9796a2890044",
        "value": "tjconsultingservices.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633676",
        "to_ids": true,
        "type": "domain",
        "uuid": "abf4dce2-a48e-4728-a844-cf9567156bcd",
        "value": "realhealthshop.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "ArcBridge WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633175",
        "to_ids": true,
        "type": "md5",
        "uuid": "7529a935-cd7e-40b4-a6b6-bfaaadeda53a",
        "value": "42f847597109da2a220391bb09d00676",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "ArcBridge WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633175",
        "to_ids": true,
        "type": "md5",
        "uuid": "82e85660-c0c3-46a9-81ee-f1976af16720",
        "value": "5fa15ef96808ea82f0a6176f0bb4b386",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "BridgeHead WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633176",
        "to_ids": true,
        "type": "md5",
        "uuid": "369a7e58-61a3-4ea1-86cc-56f55212ff11",
        "value": "6038d42af0affd1fb263f470c0956f6b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "BridgeHead WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633177",
        "to_ids": true,
        "type": "md5",
        "uuid": "17f6f9aa-3a2a-41bd-9d59-105231abc876",
        "value": "ae628efa305387b633dce82f9364875b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "ArcBridge WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633178",
        "to_ids": true,
        "type": "md5",
        "uuid": "b38487e4-80fc-4e68-94a8-918e218ff93b",
        "value": "afb1c1583606599c7272cfb33cc6f498",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633180",
        "to_ids": true,
        "type": "md5",
        "uuid": "14062430-74d2-413a-ac56-d3aa7314f532",
        "value": "c832ecd135781b11f59e3fffb3d2b6ac",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#230087",
            "local": false,
            "name": "rectifyq:samples-found-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "BridgeHead WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633180",
        "to_ids": true,
        "type": "md5",
        "uuid": "485d4dcf-a586-4401-a779-ed0e460be636",
        "value": "c90f0efadbf322e5eb1c4103a38c30e6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "BridgeHead WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633182",
        "to_ids": true,
        "type": "md5",
        "uuid": "9733c030-d75e-4d42-8344-b92566195311",
        "value": "d09b14a2fe01c7363ecc56f5d046162c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "BridgeHead WebSocket tunneling tool No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633183",
        "to_ids": true,
        "type": "md5",
        "uuid": "069b5abc-0e48-4d41-80d1-416b92e26fa8",
        "value": "f7d36cc5904a53252d2bb3d21615134f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633185",
        "to_ids": true,
        "type": "sha1",
        "uuid": "03f56e8f-8671-46d9-ad60-381f3efa8aab",
        "value": "6e85d21c17d68c7c7e3e10433a53486c5371c127",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#230087",
            "local": false,
            "name": "rectifyq:samples-found-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633185",
        "to_ids": true,
        "type": "sha256",
        "uuid": "28d5298b-06e4-432e-8c4d-3cb42254af84",
        "value": "c4a9de21aad3e71b08bfbcc827d4c242f8915e763117d254e41febe6df4807cc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#230087",
            "local": false,
            "name": "rectifyq:samples-found-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633698",
        "to_ids": true,
        "type": "url",
        "uuid": "d47cbc1f-0193-4c3d-9e67-22e26224a393",
        "value": "http://businessmixture.com/blog",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633719",
        "to_ids": true,
        "type": "domain",
        "uuid": "818b6f84-2bc2-4816-9c65-17ebe242969b",
        "value": "aecert.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633740",
        "to_ids": true,
        "type": "domain",
        "uuid": "8658913f-ce30-41dd-b74f-7d1fe0f21b6c",
        "value": "businessmixture.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633761",
        "to_ids": true,
        "type": "domain",
        "uuid": "05b8cd0e-a682-4406-a53b-e9cf7fa3c055",
        "value": "global-reds.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633782",
        "to_ids": true,
        "type": "domain",
        "uuid": "a17acb6b-a8ca-4ac7-95f2-9c562418e89e",
        "value": "maadinglobal.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633803",
        "to_ids": true,
        "type": "domain",
        "uuid": "cf4a2486-8019-4680-826a-1f99e9ff9f60",
        "value": "thehealth-life.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633824",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "377b6cba-384e-4d53-bf84-fdbfe782c22c",
        "value": "172.86.98.113",
        "Tag": [
          {
            "colour": "#652a80",
            "local": false,
            "name": "asn:asn=\"14956\"",
            "relationship_type": ""
          },
          {
            "colour": "#9f7512",
            "local": false,
            "name": "asn:as-owner=\"ROUTERHOSTING\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633845",
        "to_ids": true,
        "type": "domain",
        "uuid": "0f8bc38b-28d5-41ba-9629-3a2f52e22200",
        "value": "business-deegital.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633866",
        "to_ids": true,
        "type": "domain",
        "uuid": "31f718b3-37b9-4217-8947-780936fd455a",
        "value": "business-deegital.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633888",
        "to_ids": true,
        "type": "domain",
        "uuid": "01b34c4c-2fdf-4887-bebc-0b7ef64cc1ab",
        "value": "businessdeegital.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633909",
        "to_ids": true,
        "type": "domain",
        "uuid": "e938bf14-a8da-42c5-94ed-ff8271869352",
        "value": "neexportfolio.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633930",
        "to_ids": true,
        "type": "domain",
        "uuid": "fd44fd29-d569-449b-aece-5398c7d27137",
        "value": "neexportfolio.eastus.cloudapp.azure.com",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633952",
        "to_ids": true,
        "type": "domain",
        "uuid": "ab5fb183-ad22-47f6-8920-b870ad389190",
        "value": "healthcarezoom-centeral.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633973",
        "to_ids": true,
        "type": "domain",
        "uuid": "f4bedf4a-917e-40a4-9273-7cdbbe11796e",
        "value": "healthcarezoomcenteral.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785633994",
        "to_ids": true,
        "type": "domain",
        "uuid": "d1b12905-4faa-4dd4-b1a1-c597aa204a00",
        "value": "toadreport.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785634015",
        "to_ids": true,
        "type": "domain",
        "uuid": "03dae967-0685-47d5-abd8-7995a980f5b1",
        "value": "business-startup.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785634036",
        "to_ids": true,
        "type": "domain",
        "uuid": "c68164a3-7ba8-4a21-b696-79c616301f0d",
        "value": "businessstartup.azurewebsites.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-15T10:11:41+00:00",
        "last_seen": "2026-06-15T10:11:41+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785634057",
        "uuid": "8d760c3b-d0f4-40d3-8a80-a64a4265d5f9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "NightLedger backdoor",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "md5",
            "timestamp": "1785634057",
            "to_ids": true,
            "type": "md5",
            "uuid": "a72326be-b273-40e2-9f6b-4014c7b87ac9",
            "value": "a239e655709a2518dd0b7bdbed163679",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "NightLedger backdoor",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "sha1",
            "timestamp": "1785633173",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a78f699c-5261-404d-8633-e47086d2e91f",
            "value": "79f3ef6c6127edb0a5f43ef7a16bfb3418860e19",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "NightLedger backdoor",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "sha256",
            "timestamp": "1785633173",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b72d9edf-af2d-4222-ab5a-689effc2b9da",
            "value": "24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "text",
            "timestamp": "1785631766",
            "to_ids": false,
            "type": "text",
            "uuid": "3a169a47-94a3-4810-89c2-f24a4010674b",
            "value": "NightLedger backdoor\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/NightLedger.DA!MTB\nClamAV: None\nVT Total Detection: 37/75\nFirst Seen In The Wild: 2026-06-15T12:13:36+00:00\nFirst Submission: 2026-06-15T10:11:41+00:00\nLast Submission: 2026-06-15T10:11:41+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785631766",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f7b3b8af-4f6b-4386-9294-ce6d5a5dc8c5",
            "value": "24576:JoFW1Q4DFEDUPjvCO8yhGJbvoj7VVg0Afa61lnNd4R9kOPMKjLTNgRz/tMH3NQPw:JoFW24Dyora5AMvoj7c0bPbkOPMUNgRN"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785631766",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "5e4dcdb3-708d-4be4-ac65-863b38f26cfa",
            "value": "1110528"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "vhash",
            "timestamp": "1785631766",
            "to_ids": true,
            "type": "vhash",
            "uuid": "c2bc6425-4d42-4cdf-888a-6484f3a9e2c7",
            "value": "116066655d15551557z7006b7z2dz3dz6f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-15T10:11:41+00:00",
            "last_seen": "2026-06-15T10:11:41+00:00",
            "object_relation": "filename",
            "timestamp": "1785631766",
            "to_ids": true,
            "type": "filename",
            "uuid": "e5ac0a2f-5e4e-49a7-b370-9fa27f4f6bf8",
            "value": "a239e655709a2518dd0b7bdbed163679___dd5dc17b-5d56-453a-bc8b-e25f6223eec0.dll"
          }
        ]
      }
    ]
  }
}