{
  "Event": {
    "analysis": "1",
    "date": "2026-07-20",
    "extends_uuid": "",
    "info": "[Threat Intel] Operation STANDOFF: A Campaign Hiding C2 Behind GitHub Redirects",
    "protected": false,
    "publish_timestamp": "1785033936",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785033936",
    "uuid": "ce130b4e-3ff6-4dec-88a6-02accde0c71b",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c57c8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#90e6f2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal or Forge Kerberos Tickets - T1558\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#f4b62b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#423494",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify System Firewall - T1562.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d11f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#07ff3c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4bc785",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Amadey\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Glupteba\"",
        "relationship_type": ""
      },
      {
        "colour": "#cf622d",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Raccoon\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"Amadey\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"Glupteba\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"Qbot\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Latrodectus\"",
        "relationship_type": ""
      },
      {
        "colour": "#f3c486",
        "local": false,
        "name": "misp-galaxy:malpedia=\"RedLine Stealer\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"SmokeLoader\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Socelars\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"xmrig\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784689207",
        "to_ids": false,
        "type": "link",
        "uuid": "20fb0ae4-a5f4-4d6a-95e3-30de0f75de1f",
        "value": "https://www.vmray.com/execution-level-analysis-of-a-russian-speaking-multi-operator-intrusion-campaign-operation-standoff/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784689207",
        "to_ids": false,
        "type": "text",
        "uuid": "74e71db1-099c-4016-8e14-8d6ab57c37dc",
        "value": "VMRay Labs uncovered a sophisticated Russian-speaking cybercriminal operation combining multiple attack vectors on shared infrastructure. The campaign distributes commodity stealers including Raccoon, RedLine, Amadey, SmokeLoader, Socelars, and Glupteba through a pay-per-install loader while enrolling victims into a proxy-botnet. Command-and-control servers on Russian provider TimeWeb use GitHub domain redirects for concealment. A custom multi-operator console called STANDOFF COORD coordinates hands-on-keyboard intrusions targeting Active Directory environments, storing NTLM hashes, Kerberos tickets, and credentials organized by network segments. Additionally, the infrastructure hosts an AI-driven influence operation using industrial-scale Telegram account farms and automated engagement platforms targeting Russian-speaking mobile gaming communities through a portal called Mobile Arena, driving traffic toward gambling sites and malware distribution."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784689207",
        "to_ids": false,
        "type": "text",
        "uuid": "96561b96-9506-4243-9b15-f6aa6588d477",
        "value": "Name: Operation STANDOFF: A Campaign Hiding C2 Behind GitHub Redirects\nAuthor: AlienVault\nAdversary: Operation STANDOFF\nTags: [\"glupteba\", \"redline\", \"proxy-botnet\", \"russian-speaking\", \"telegram-account-farm\", \"amadey\", \"socelars\", \"smokeloader\", \"ai-driven-influence\", \"active-directory-targeting\", \"timeweb-infrastructure\", \"raccoon stealer\", \"pay-per-install\", \"xmrig\", \"github-redirect-concealment\"]\nTgtd countries: []\nMlwr families: [\"Raccoon Stealer\", \"RedLine\", \"Amadey - S1025\", \"SmokeLoader\", \"Socelars\", \"Glupteba\", \"XMRig\"]\nAttack_ids: [\"T1053.005\", \"T1036.005\", \"T1543.003\", \"T1497.001\", \"T1082\", \"T1005\", \"T1140\", \"T1558\", \"T1055\", \"T1497.003\", \"T1562.004\", \"T1112\", \"T1552.004\", \"T1003.001\", \"T1083\", \"T1552.001\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1055.012\", \"T1027\", \"T1573\", \"T1012\", \"T1518.001\", \"T1059.003\", \"T1027.002\", \"T1071.001\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784689207",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "f783251f-5631-44ff-be9a-7d8de6000c22",
        "value": "Operation STANDOFF"
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030958",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "756a90e5-2115-4aa6-b51c-8bdef58d91e6",
        "value": "188.225.72.157",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785030981",
        "to_ids": true,
        "type": "domain",
        "uuid": "cc3a83db-f254-48a0-9b2e-b0d045e1ce5f",
        "value": "listincode.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031002",
        "to_ids": true,
        "type": "hostname",
        "uuid": "d9f30239-40b4-4d28-b5d0-d9fe07425d79",
        "value": "www.listincode.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Amadey / Loader Panels",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031023",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "77b338b4-ac84-4331-a379-eaa2e203e120",
        "value": "185.215.113.35",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784689207",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "e2707a4b-ce83-496e-8a40-573992ae88be",
        "value": "CVE-2021-34527"
      },
      {
        "category": "Network activity",
        "comment": "Amadey / Loader Panels",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031045",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4aa882b7-fc4b-442a-b186-c39013bdadad",
        "value": "212.192.241.62",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031066",
        "to_ids": true,
        "type": "domain",
        "uuid": "43f38a0b-0a0c-45ae-9243-6d8ba2cf4846",
        "value": "wfsdragon.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031088",
        "to_ids": true,
        "type": "domain",
        "uuid": "2e1b6ccf-546a-4986-97b4-3749edc4b991",
        "value": "topniemannpickshop.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031110",
        "to_ids": true,
        "type": "url",
        "uuid": "1b2601a0-53b0-4a89-baec-9f37e82d47d9",
        "value": "http://wfsdragon.ru/api/setStats.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031131",
        "to_ids": true,
        "type": "domain",
        "uuid": "d2c39575-c099-4e92-a662-9c19ce9f58b5",
        "value": "all-mobile-pa1ments.com.mx",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031153",
        "to_ids": true,
        "type": "domain",
        "uuid": "ce6fd4fc-caa5-427f-89b8-b04e67308dbe",
        "value": "buy-fantasy-gxmes.com.sg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031174",
        "to_ids": true,
        "type": "domain",
        "uuid": "13e7fe1f-7e11-4b62-93db-4a752a4c142b",
        "value": "buy-fantasy-football.com.sg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "campaign-specific C2 server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031196",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "258db746-0e41-4128-9a19-41136d403083",
        "value": "212.193.30.29",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031217",
        "to_ids": true,
        "type": "domain",
        "uuid": "7605862f-8ebb-4a85-829a-0bded5969134",
        "value": "new-androidapps.me",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\u201cborderxra\u201d download paths",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031239",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e9eb58be-12b1-4427-9497-8b93c69b4e37",
        "value": "185.225.19.18",
        "Tag": [
          {
            "colour": "#946f44",
            "local": false,
            "name": "asn:asn=\"39798\"",
            "relationship_type": ""
          },
          {
            "colour": "#dc48b6",
            "local": false,
            "name": "asn:as-owner=\"MIVOCLOUD\"",
            "relationship_type": ""
          },
          {
            "colour": "#9ca493",
            "local": false,
            "name": "asn:as-country=\"MD\"",
            "relationship_type": ""
          },
          {
            "colour": "#4f4d08",
            "local": false,
            "name": "misp-galaxy:country=\"moldova\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031260",
        "to_ids": true,
        "type": "domain",
        "uuid": "22a678df-35b7-4711-bbcb-6553fbc1487f",
        "value": "rcacademy.at",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031281",
        "to_ids": true,
        "type": "domain",
        "uuid": "38558212-98ec-4607-8249-179f1a07901f",
        "value": "cloudjah.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031302",
        "to_ids": true,
        "type": "url",
        "uuid": "3c211372-c624-482b-95d8-7912015ffbb6",
        "value": "http://cloudjah.com/77_1.exe",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "RedLine Stealer C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031323",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cf4f4a56-8518-46c8-841b-b2b52b215d45",
        "value": "185.215.113.44",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "campaign-specific C2 server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031345",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "72fb6b7d-3010-4593-b38b-6acee4a55321",
        "value": "212.193.30.45",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031366",
        "to_ids": true,
        "type": "url",
        "uuid": "64b0c7af-9d0e-4354-a697-b7be14f3d81a",
        "value": "http://212.193.30.45/proxies.txt",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031388",
        "to_ids": true,
        "type": "url",
        "uuid": "7911e7cc-05e1-4aa6-bceb-4e49286a29c5",
        "value": "http://rcacademy.at/upload/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031409",
        "to_ids": true,
        "type": "url",
        "uuid": "61d606c2-c6d2-4517-89c1-bcf4d2f7d257",
        "value": "http://212.192.241.62/base/api/statistics.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031430",
        "to_ids": true,
        "type": "url",
        "uuid": "45e8bdfd-0382-41f5-9046-511c904b6eb9",
        "value": "http://185.215.113.35/d2VxjasuwS/index.php",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031451",
        "to_ids": true,
        "type": "hostname",
        "uuid": "84bb8323-a926-429a-bfb0-562e9c87bef2",
        "value": "www.wgqpw.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031472",
        "to_ids": true,
        "type": "hostname",
        "uuid": "cee62280-d09e-4f33-af33-91e10b860fd1",
        "value": "server5.trumops.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031494",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "dc4fdfbc-3bb3-4f41-bec0-365ff0822e54",
        "value": "147.45.183.198",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031515",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57ccc406-0c08-4af3-ad4c-2bd24cc52c28",
        "value": "147.45.237.23",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031536",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b5c64f7f-e262-46f2-b068-370ad7ae96dc",
        "value": "185.247.185.85",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031557",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9e690419-ca25-489b-b07b-219537ab4a46",
        "value": "188.225.39.252",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031579",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6a50fbc1-02ea-4679-bd1a-897e1243c4a3",
        "value": "188.225.82.125",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031600",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0d159d80-941a-4527-becf-02fd08089ffb",
        "value": "194.87.131.30",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031622",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "18d8968f-ba1b-4eae-91d5-1cc92e9b9f84",
        "value": "194.87.56.156",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031643",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7e81fe89-52df-43b7-918c-124181413ab2",
        "value": "195.133.73.225",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031665",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0cbcc3ae-a2a6-465e-a5df-8ebf20965d05",
        "value": "212.60.21.249",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "second server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031686",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "cc9219af-126c-43d1-bff0-d9a93c9023ae",
        "value": "217.198.13.211",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031707",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "237e087f-da2b-4110-9c91-b35d2a657460",
        "value": "37.252.21.227",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031728",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f8fd0c51-23b2-4277-959e-66c12c9d985e",
        "value": "45.139.78.67",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031749",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "db585ea8-d7f4-427c-b6f5-b9e9a38cd575",
        "value": "46.149.70.18",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031770",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2d1ec2d8-5a80-4256-a973-a38190f1cfe9",
        "value": "5.129.196.85",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031792",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9264f76a-e535-4409-a632-2042fd210a9a",
        "value": "89.223.71.207",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031813",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a6944076-86fc-4dba-9bf3-6dc41595bc7f",
        "value": "90.156.224.57",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031834",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a32143db-6a66-4f07-a97b-9454b06354f5",
        "value": "92.51.22.34",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031855",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6ed785d8-17ff-4213-bc61-29e72d5f5285",
        "value": "93.183.80.126",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031878",
        "to_ids": true,
        "type": "url",
        "uuid": "e4f1f0e6-4126-47fb-9d80-8e3c2e28ac10",
        "value": "http://bulldrops.ru",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031899",
        "to_ids": true,
        "type": "url",
        "uuid": "f520107a-ce2f-4767-b138-cc2148990802",
        "value": "http://loopaai.ru",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031920",
        "to_ids": true,
        "type": "url",
        "uuid": "32e8061d-c028-47b7-bfa1-5b9c86256e7c",
        "value": "http://n.data??[]",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031941",
        "to_ids": true,
        "type": "url",
        "uuid": "f55d99a4-b5a0-42f9-940d-5e3b4eeca681",
        "value": "http://noc.social/@menaomi",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031963",
        "to_ids": true,
        "type": "url",
        "uuid": "3db2a75f-e269-4a05-aa27-b454d4c64fa0",
        "value": "http://www.loopaai.ru",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785031984",
        "to_ids": true,
        "type": "url",
        "uuid": "5a24868a-63d9-44af-b068-530723f3fafd",
        "value": "http://www.xn--90aguaqgfu.xn--p1ai",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032005",
        "to_ids": true,
        "type": "url",
        "uuid": "b6a3ef40-6919-41c9-9a1d-846de0402db0",
        "value": "http://xn--90aguaqgfu.xn--p1ai",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032026",
        "to_ids": true,
        "type": "url",
        "uuid": "e8a0f66d-a205-402a-80db-2ec96ff141dd",
        "value": "https://212.193.30.29/assets/index-CxeLM22L.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "hardcoded to call a backend API",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032047",
        "to_ids": true,
        "type": "url",
        "uuid": "4f297bcf-7d72-447d-97e4-220511dd4838",
        "value": "https://api.russianhackers.online",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032068",
        "to_ids": true,
        "type": "domain",
        "uuid": "2fe07d43-7260-42a1-ab1d-d6507d054aea",
        "value": "bull-drops.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032089",
        "to_ids": true,
        "type": "domain",
        "uuid": "597593dd-24b0-4940-9794-d34952bbe32d",
        "value": "bull-drops.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032111",
        "to_ids": true,
        "type": "domain",
        "uuid": "b46337c1-3289-4ca8-9f36-a4a2edcff624",
        "value": "bulldrops.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032133",
        "to_ids": true,
        "type": "domain",
        "uuid": "db29745c-7bef-4047-88f0-7e2750ed9680",
        "value": "bulldrops.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032155",
        "to_ids": true,
        "type": "domain",
        "uuid": "3f9ed8e3-cfef-45b4-9569-d4fba98b866a",
        "value": "ggstandoff.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032176",
        "to_ids": true,
        "type": "domain",
        "uuid": "eadd02b1-c439-4dde-9f0a-1015e87d00e7",
        "value": "influencesite.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032197",
        "to_ids": true,
        "type": "domain",
        "uuid": "384a4341-9ada-44e9-b926-eb46d74e80a0",
        "value": "loopaai.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032218",
        "to_ids": true,
        "type": "domain",
        "uuid": "9216649e-472f-484e-9f9e-7e655e9a7029",
        "value": "mobilearena.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032239",
        "to_ids": true,
        "type": "domain",
        "uuid": "a1e421d0-031c-4eca-9de4-0c077b0d0ec4",
        "value": "russianhackers.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032261",
        "to_ids": true,
        "type": "domain",
        "uuid": "152808be-f2ea-45e9-8948-73fdb6de0435",
        "value": "russianhckers.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032282",
        "to_ids": true,
        "type": "domain",
        "uuid": "2278e692-e35d-4499-a03b-c7b8b984521a",
        "value": "xn----9sbhgocsfmg4a1kfg.xn--p1ai",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032303",
        "to_ids": true,
        "type": "domain",
        "uuid": "d393b910-1d7f-43b4-b2f9-90745b437f58",
        "value": "xn--90aguaqgfu.xn--p1ai",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032325",
        "to_ids": true,
        "type": "domain",
        "uuid": "83eedfbb-8301-4be1-87de-d0c5f5d5e9ad",
        "value": "zadrot.gg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032346",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5b0dd599-18d7-4620-89c0-82536a7122f4",
        "value": "api.russianhackers.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032367",
        "to_ids": true,
        "type": "hostname",
        "uuid": "122c56af-3e4e-47cb-a002-3ca430802e4e",
        "value": "gginfluence.influencesite.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032389",
        "to_ids": true,
        "type": "hostname",
        "uuid": "80faea50-c4ff-480f-b607-57b28037dfa2",
        "value": "www.loopaai.ru",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032410",
        "to_ids": true,
        "type": "hostname",
        "uuid": "17314d4c-e682-451d-b9f2-b467527f00a9",
        "value": "www.mobilearena.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032431",
        "to_ids": true,
        "type": "hostname",
        "uuid": "bc4c7458-255a-467e-b8fa-928a2b2ccc10",
        "value": "www.xn----9sbhgocsfmg4a1kfg.xn--p1ai",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032452",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1383c107-c3bf-48fb-b7cb-44139943f76a",
        "value": "www.xn--90aguaqgfu.xn--p1ai",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...and the XMRig pool pool.supportxmr.com:3333), the 212.193.30.0/24 pair, by contrast, is specific to the campaign...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032473",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4a597b0c-dca5-4dac-ae57-8fd8283968e7",
        "value": "212.193.30.0",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032494",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6bf61e27-4a87-4cea-a574-6d83e2d2ed5c",
        "value": "5.129.208.108",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032516",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a5bc24ff-3360-4a99-a8f2-36f8a13b8f73",
        "value": "5.129.209.17",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032537",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "50b2b54f-7231-4fe4-a44d-0068f6decf50",
        "value": "5.129.209.58",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032558",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b4527e72-bb95-4042-b320-6256c56f702c",
        "value": "5.129.210.32",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032579",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1f321fd2-5738-4be9-8bfb-aa9923c52492",
        "value": "5.129.210.139",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032600",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "71eaac03-e7a6-4d8e-a14a-241c21d56bfa",
        "value": "5.129.214.85",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032621",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "4b654c74-d1ea-4988-ad78-a3a49423ec18",
        "value": "5.129.216.104",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032643",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "58ab70c9-c018-4ed4-821f-a34b8ada946d",
        "value": "5.129.217.228",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032664",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5d0adc72-ba6f-4808-9253-beec7fb2f448",
        "value": "5.129.219.114",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032685",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "779b5ad5-c5de-4bd3-8c01-f920d581f51a",
        "value": "5.129.225.220",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032707",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c7dc0ee5-c2ab-4923-87fb-5eb13fffcb64",
        "value": "5.129.226.97",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032728",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "77812479-b27c-4eb5-9e88-8d811e95a62b",
        "value": "5.129.213.59",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032749",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c0745dc7-875b-4e5f-a76f-c00489fe768f",
        "value": "5.129.213.241",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032771",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5c71166b-f883-48ae-86de-8644b3571036",
        "value": "5.129.227.196",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032792",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "573716d3-d012-4860-bea9-41765939436d",
        "value": "5.129.231.176",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032813",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a72fc652-27b2-484b-99c4-2c724cb8d898",
        "value": "5.129.231.240",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032834",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2d385b9e-4a03-441d-8b27-844f0babdd2b",
        "value": "5.129.233.99",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032855",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c75e7a61-699e-49b1-a939-c9fa34db7712",
        "value": "5.129.236.52",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032876",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2679b160-8295-41e5-a5ea-e1a3275c0d56",
        "value": "5.129.236.68",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032898",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "eacaa984-c2fd-4590-922a-276d8c803d1e",
        "value": "5.129.237.19",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032919",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "30383b25-ea61-4a1e-9e8f-ab6aef93d34c",
        "value": "5.129.237.53",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032940",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "02c3514a-c057-41f4-82fa-fec159eb383a",
        "value": "5.129.238.90",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032961",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "01bb14cc-a12c-4c0e-bb0e-6d9ea9bc17bb",
        "value": "5.129.238.104",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785032982",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "be1bfee8-7d65-4d75-a015-2a324dcd39f5",
        "value": "5.129.238.105",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033003",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5e4ac09a-4843-42d2-a52f-a37be8ebcd4f",
        "value": "5.129.239.229",
        "Tag": [
          {
            "colour": "#9f06da",
            "local": false,
            "name": "asn:asn=\"210976\"",
            "relationship_type": ""
          },
          {
            "colour": "#f96f24",
            "local": false,
            "name": "asn:as-owner=\"TWC-EU\"",
            "relationship_type": ""
          },
          {
            "colour": "#2292d9",
            "local": false,
            "name": "asn:as-country=\"KZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"kazakhstan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033024",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "015376d9-3663-47d0-840e-de74e74b3582",
        "value": "5.129.242.37",
        "Tag": [
          {
            "colour": "#bcde63",
            "local": false,
            "name": "asn:asn=\"9123\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c7ad8",
            "local": false,
            "name": "asn:as-owner=\"TIMEWEB-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#fdd220",
            "local": false,
            "name": "asn:as-country=\"RU\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"russia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033045",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "97b69264-a70a-40d1-8b58-29d598803b78",
        "value": "104.247.81.99",
        "Tag": [
          {
            "colour": "#8809af",
            "local": false,
            "name": "asn:asn=\"206834\"",
            "relationship_type": ""
          },
          {
            "colour": "#67f1c9",
            "local": false,
            "name": "asn:as-owner=\"TEAMINTERNET-CA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033067",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "38674a8c-15a4-480d-be5d-21789fc551cf",
        "value": "188.40.141.211",
        "Tag": [
          {
            "colour": "#d17f93",
            "local": false,
            "name": "asn:asn=\"24940\"",
            "relationship_type": ""
          },
          {
            "colour": "#18e065",
            "local": false,
            "name": "asn:as-owner=\"HETZNER-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033088",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c66a3b0c-e2b0-40d6-ad2c-454fdfcded47",
        "value": "91.219.236.207",
        "Tag": [
          {
            "colour": "#153b63",
            "local": false,
            "name": "asn:asn=\"56322\"",
            "relationship_type": ""
          },
          {
            "colour": "#c82368",
            "local": false,
            "name": "asn:as-owner=\"SERVERASTRA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#0442e9",
            "local": false,
            "name": "asn:as-country=\"HU\"",
            "relationship_type": ""
          },
          {
            "colour": "#78181f",
            "local": false,
            "name": "misp-galaxy:country=\"hungary\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033109",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "488b930b-2554-40c1-8145-e6d94152cf35",
        "value": "91.219.237.227",
        "Tag": [
          {
            "colour": "#153b63",
            "local": false,
            "name": "asn:asn=\"56322\"",
            "relationship_type": ""
          },
          {
            "colour": "#c82368",
            "local": false,
            "name": "asn:as-owner=\"SERVERASTRA-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#0442e9",
            "local": false,
            "name": "asn:as-country=\"HU\"",
            "relationship_type": ""
          },
          {
            "colour": "#78181f",
            "local": false,
            "name": "misp-galaxy:country=\"hungary\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033130",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "46d2dc7a-acc6-4d0b-8cdb-4a74da14f4aa",
        "value": "3.229.117.57",
        "Tag": [
          {
            "colour": "#92678d",
            "local": false,
            "name": "asn:asn=\"14618\"",
            "relationship_type": ""
          },
          {
            "colour": "#e68e4d",
            "local": false,
            "name": "asn:as-owner=\"AMAZON-AES\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033151",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e892d837-8342-4e9a-873b-36046f594dae",
        "value": "172.237.145.27",
        "Tag": [
          {
            "colour": "#680e86",
            "local": false,
            "name": "asn:asn=\"63949\"",
            "relationship_type": ""
          },
          {
            "colour": "#edf21f",
            "local": false,
            "name": "asn:as-owner=\"AKAMAI-LINODE-AP Akamai Connected Cloud\"",
            "relationship_type": ""
          },
          {
            "colour": "#d906de",
            "local": false,
            "name": "asn:as-country=\"SG\"",
            "relationship_type": ""
          },
          {
            "colour": "#ad61df",
            "local": false,
            "name": "misp-galaxy:country=\"singapore\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033172",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "083216eb-4f65-469b-94b3-d696730733ba",
        "value": "65.108.69.168",
        "Tag": [
          {
            "colour": "#d17f93",
            "local": false,
            "name": "asn:asn=\"24940\"",
            "relationship_type": ""
          },
          {
            "colour": "#18e065",
            "local": false,
            "name": "asn:as-owner=\"HETZNER-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033193",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5150d02a-f754-4c26-abd0-e8f166593254",
        "value": "23.88.118.113",
        "Tag": [
          {
            "colour": "#d17f93",
            "local": false,
            "name": "asn:asn=\"24940\"",
            "relationship_type": ""
          },
          {
            "colour": "#18e065",
            "local": false,
            "name": "asn:as-owner=\"HETZNER-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#141680",
            "local": false,
            "name": "asn:as-country=\"DE\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"germany\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "location header",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033215",
        "to_ids": true,
        "type": "url",
        "uuid": "b5afb2f9-2206-4ab9-9d24-ceb0d9d7a633",
        "value": "https://212.193.30.29/server.txt",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "components in the bundle resolve follow-on addresses through dead-drop resolvers hosted on legitimate platforms",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033236",
        "to_ids": true,
        "type": "url",
        "uuid": "85771194-4850-44aa-98a6-68cff20120ae",
        "value": "http://t.me/borderxra",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "components in the bundle resolve follow-on addresses through dead-drop resolvers hosted on legitimate platforms",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033257",
        "to_ids": true,
        "type": "url",
        "uuid": "54cb49cc-2fd5-49de-ab0c-dfd6cdf8b52b",
        "value": "http://t.me/jredmankun),",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "the malware\u2019s plaintext request to this",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033278",
        "to_ids": true,
        "type": "url",
        "uuid": "ace3746a-7fba-4e5b-97e3-3fe14f431592",
        "value": "http://212.193.30.29/server.txt",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033299",
        "to_ids": true,
        "type": "url",
        "uuid": "126ddab8-ee6f-4dd3-93eb-2c6a90574345",
        "value": "https://212.193.30.29/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"....30[.]29/ whose HTML loads a JavaScript bundle at https://212.193.30[.]29/assets/index-CxeLM22L.js. As Figure 13 shows, this console is branded \u201cSTAN...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033320",
        "to_ids": true,
        "type": "url",
        "uuid": "95e5ed89-60fd-4826-a7ae-94d522795a22",
        "value": "https://212.193.30.29/assets/index-CxeLM22L.js.",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...sg ; new-androidapps.me ; topniemannpickshop.cc ; blvckxxx.beget.tech Host-Based Indicators Staging directory: %LO...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033341",
        "to_ids": true,
        "type": "domain",
        "uuid": "d548821a-5a71-45f0-80df-9f2080985421",
        "value": "blvckxxx.beget.tech",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...automation platform, served from a backend API at http://217.198.13[.]211:8002/api/v1. It is divided into fourteen functional areas: Se...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033362",
        "to_ids": true,
        "type": "url",
        "uuid": "877b6a13-3a9c-41d9-83e8-edb3f1268bdd",
        "value": "http://217.198.13.211:8002/api/v1.",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Dead-Drop Resolvers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033383",
        "to_ids": true,
        "type": "url",
        "uuid": "97243aa0-3398-423f-a96b-c51dd9703e89",
        "value": "http://t.me/borderxra;",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Pay-per-Install Hosting (Scaleway S3)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033404",
        "to_ids": true,
        "type": "domain",
        "uuid": "fcc38527-2678-4b90-8605-7bdddaed4c35",
        "value": "coffee-music-laptop.s3.pl-waw.scw.cloud",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Pay-per-Install Hosting (Scaleway S3)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785033425",
        "to_ids": true,
        "type": "domain",
        "uuid": "65bd60d1-17cf-4427-991b-64e3081e1ed7",
        "value": "hammajawa7dou.s3.nl-ams.scw.cloud",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2021-12-06T23:33:58+00:00",
        "last_seen": "2026-05-12T16:20:49+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785033446",
        "uuid": "69e6acfe-ad83-4df5-adee-43f2a02ebe15",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "The initial sample led to the infection and investigated",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "md5",
            "timestamp": "1785033446",
            "to_ids": true,
            "type": "md5",
            "uuid": "b53a206e-9809-4f01-b98c-57bc126d2b30",
            "value": "e77221d7a4b47b9107ba1b61a551ca89",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "The initial sample led to the infection and investigated",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899557",
            "to_ids": true,
            "type": "sha1",
            "uuid": "12fa011c-f92a-4ce8-b234-c830061adafb",
            "value": "95c5ae3fec0d900e4634e11b3ad81971e78e2b31",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "The initial sample led to the infection and investigated",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899557",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f9b72432-f699-4385-a656-a74af13e86ec",
            "value": "22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 21/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "text",
            "timestamp": "1784899190",
            "to_ids": false,
            "type": "text",
            "uuid": "2fecb485-f165-4201-8afc-c7252652b57d",
            "value": "The initial sample led to the infection and investigated\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Vindor!pz\nClamAV: Win.Packed.Barys-9859531-0\nVT Total Detection: 41/74\nFirst Submission: 2021-12-06T23:33:58+00:00\nLast Submission: 2026-05-12T16:20:49+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784899190",
            "to_ids": false,
            "type": "datetime",
            "uuid": "7ab3c2d2-a99b-461d-afb9-b01de8568414",
            "value": "2020-08-01T02:44:18+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784899190",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0e935f65-373d-46d5-b4f0-2d75b037fc66",
            "value": "393216:JRoKCcQvnMSJ6zvNtzVqh5k0JBUQzoYfh5Y8B9u0JPG8Z+a9:J8vBgzvNu5BztZy8Hhwk9"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784899190",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "9f9e76de-c208-40c8-95a5-73464ff5e401",
            "value": "17461114"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "vhash",
            "timestamp": "1784899190",
            "to_ids": true,
            "type": "vhash",
            "uuid": "f989f532-debc-4464-b5e1-6418742fb9fd",
            "value": "017056655d1c0510d043z800417z57z62z4gz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2021-12-06T23:33:58+00:00",
            "last_seen": "2026-05-12T16:20:49+00:00",
            "object_relation": "filename",
            "timestamp": "1784899190",
            "to_ids": true,
            "type": "filename",
            "uuid": "65daa213-4cf8-42e1-b932-a40783798843",
            "value": "setup_x86_x64_install.exe"
          }
        ]
      }
    ]
  }
}