{ "type": "bundle", "id": "bundle--0ece5f18-a18b-4014-ae8d-e57f829253c6", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "created": "2024-01-01T00:00:00.000Z", "modified": "2024-01-01T00:00:00.000Z", "name": "TI Mindmap HUB", "identity_class": "organization" }, { "type": "report", "id": "report--6a9f2a4f-508c-4a45-aaa3-fc0ad4609995", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The Agentic AI Attack Wave: ARTEX Industrializes Autonomous Intrusion", "description": "Autonomous AI agents moved from September proofs to ARTEX-driven espionage, supply-chain and bank intrusions, while AI stacks became targets too.", "report_types": [ "threat-report" ], "published": "2026-09-27T00:00:00.000Z", "object_refs": [ "indicator--fcc6e4f1-393f-43d9-b7a0-e89cb5bafdf2", "indicator--c4e792ce-d211-4a06-b605-4742a103fe8f", "indicator--d690629e-c8a0-420d-9b08-bce9600b269e", "indicator--3779f2dc-89c6-4710-9c34-d30af34afbef", "indicator--add24405-feb0-4ac0-bcfb-1599e0f742d3", "indicator--bef24097-b524-460d-abb2-efb5b0aa3987", "indicator--3a7a905a-5b88-456c-ae66-6c19d87fd7e6", "indicator--da5211ca-3e75-4010-b584-73568612936d", "indicator--9f6bc23a-9924-4dc2-abc3-b6e8e03b869c", "indicator--959e87ec-950c-4c82-aa65-0e4cf4d8cc0a", "indicator--e8b0f6a7-f4df-490a-9e7d-84bfa5bf21d1", "indicator--640feef6-b9c2-4be8-80a1-a7537c52c09e", "indicator--d4b7cb0a-25b6-4fb8-a12a-4470ac9d8195", "indicator--652f82df-48fd-4f0e-8511-56e29923f7e3", "indicator--708526be-ed2a-457e-9937-0615a1fd3af0", "indicator--30b1cc86-cadc-432f-a9e9-5b5097322a5f", "indicator--1ebdc503-eefd-4638-86cf-4eb413c3ac22", "indicator--7428c35d-8dab-4916-87e0-88b9d836cfbb", "indicator--9a9b3331-146e-403a-9373-3f781ea39d74", "indicator--85b6c725-c699-4589-a78d-2c140e844018", "indicator--0e9a641b-acc7-4ecd-9957-132eda74a317", "indicator--1ebb75c2-361e-4141-a442-4ded97e3bdbb", "indicator--77786156-4cbb-46d4-bc35-4802c22ebb0a", "indicator--83bf591c-69c1-4ac5-86bc-78a9a2c0c39d", "indicator--27b670c5-9902-4428-a4e8-f413e77f3715", "indicator--14dc2465-0bf6-4142-b45d-bef8b4696180", "indicator--67a1cf54-4d98-47d4-ac6e-15a7bd8c5c99", "indicator--7697377c-9cc5-45ff-bec1-a7139b98acb0", "indicator--09c71c16-5e38-455e-bf6e-3bf3d4d620be", "indicator--72e2c8bc-1cb1-4ec7-bd9f-40c9b0284572", "indicator--8b7db7ab-6e9d-442a-b2a6-32639decb8a7", "indicator--ef04b725-7fae-4c1c-bfff-d3bf4662eea7", "indicator--a29e160f-315d-45c2-957d-bcb654b28068", "indicator--b24cdfd8-d215-462a-a832-dcc9253f24c2", "indicator--2bf889cc-564c-4e78-bd74-ff0b849ba46b", "indicator--03240a43-5c49-4953-96f8-854ebbac2581", "indicator--a554742a-6d3d-4f9f-927b-759da489bba6", "indicator--92ea76e9-997e-43fc-a0fc-e66c4f8d707f", "indicator--99697131-25b0-4657-9c7f-3f9a74564cef", "indicator--cb42cea3-8b03-4981-93d9-bb6e7634c19d", "indicator--b5822d2f-1fc3-4cca-944b-4ccbe50831a6", "indicator--ce8d0aa3-d3ea-49a5-913e-3def99904f41", "indicator--a570d6fc-c89a-41d8-ae35-cfc49f98bf31", "indicator--a1466c03-89db-4688-87ea-efa1ae5b8732", "indicator--82bdd3ea-f1ce-40e2-856a-a405ce2e8786", "indicator--acd57b8c-0ff7-4741-87fd-525ffca9038c", "indicator--5eaacc1b-2e2c-45a3-a600-604acaeb23cb", "indicator--43e6ab22-4b99-4b5c-8645-cb434c3dcf72", "indicator--9aec9595-0e29-49f3-9a4b-fb0878a1e04e", "indicator--b9c10ed6-b575-4ba8-8869-65983fb40147", "indicator--120f2f4f-9399-4482-b7c9-3197b4d30433", "indicator--b6ee69cc-df72-4c61-841a-c07ce6043914", "indicator--b994c5ad-daaa-4739-85f7-8c82553f61c4", "indicator--f1bb6fc8-5bb8-4e72-8810-dbf94caca24f", "indicator--1f99e3d7-ab38-4544-8815-a78255605b75", "indicator--852d750b-885c-4e76-b5ac-41078765e1a5", "indicator--684b47ee-aac5-43f6-8f9a-ced883b95822", "indicator--17d12164-048b-41a5-9c1a-fbaa2dbac298", "indicator--c7baa264-0b8b-4d74-8e67-862e3f97b2ef", "indicator--16b038ee-abfb-4e17-854a-95b84946e431", "indicator--b11fbef4-3065-44d5-90a1-13c0eb1a7ee9", "indicator--216548c6-7165-464f-be2f-53eb77e720d6", "indicator--368038da-9fdc-40b8-8ff9-94e86a4f8667", "indicator--cd5f1ecb-3a1b-47d7-83fc-9c0faab079a1", "indicator--05c1f32f-6409-4879-9c83-d65e3a89cccf", "indicator--f6287848-23e5-4fcd-b676-db46019b48d8", "indicator--a978ed35-98bb-43ba-a189-a766b7e4f6f8", "indicator--d66faf33-2227-4a7e-9675-064db590be3b", "indicator--dc09fec1-99c7-438b-8e97-10410e5b0ad9", "indicator--e93df0b0-8b36-48c5-8fd1-0937e28f56b8", "indicator--b18aaa26-a0a9-4911-9549-f77250f94c68", "indicator--838e7bb7-9aed-4dd6-b84d-099587373ecd", "indicator--f7b3bf27-4030-4ff3-9fa2-27d9922a3835", "indicator--ac991173-5242-42e7-9308-e2427b4c8b5b", "indicator--b023ccff-ce78-4fe2-bea1-8ef25360adf6", "indicator--0f1c6f1b-0099-4d54-8370-51e3a152fb22", "indicator--ac182ea8-5ed1-4d52-80ff-5252e4497f59", "indicator--2922cf1d-1ec5-4706-a989-5fc108ebad6c", "indicator--deb0324d-1cee-48b2-a1bf-1e109604d8e1", "indicator--14b2895a-7ea3-4fbb-9995-ecdd4adfb9b4", "indicator--8fa3173a-97e9-4a15-90c2-fe6c7d1bc405", "indicator--c6cfff09-0eeb-44c2-a98f-5af343d76695", "indicator--8fdfdab7-4fdb-4c4a-9d24-95c7de1a2804", "indicator--63246ced-0ab9-4899-b152-1d36fa6e138f", "indicator--dd849ca2-dbd6-439c-88f2-83d272e993f7", "indicator--8fe7606b-0cdc-4225-bdf2-4d8cbcfb052f", "indicator--a908dbdb-8372-4231-b83f-91d093755993", "indicator--c9c2034b-a388-4962-b92a-ddd6e4c994ea", "indicator--1f0f9f12-4dc0-46f7-ad1d-43b2021017ea", "indicator--4485ee22-3015-4c79-a63a-50c1e58581b9", "indicator--de038752-934c-4c5b-ace5-25a8d9faf896", "indicator--79383494-c2ce-4fe2-b966-00b97ca5f7d0", "indicator--eb9af709-8558-42cd-9a91-903fb8641f47", "indicator--f87ac36e-900a-4bb4-8fdc-db42b36bcdea", "indicator--5acc6f88-1545-4a04-8df2-7dac5e411cc3", "indicator--25b89f92-b7bf-4042-9117-82a78e4c4423", "indicator--f8fbeeff-b491-4154-a643-f2ccf8657175", "indicator--b9d46a2a-deaa-493e-9bb8-cc7f7c5e5969", "indicator--ebed013e-4276-4adc-b46a-8a7b2b38b310", "indicator--6c95ca3d-a3ee-4d19-9c6e-772f6c101968", "indicator--ea616b63-0d73-4d1d-bb01-1b5771293e6b", "indicator--688cd94c-abaa-4193-988e-31e6f2778d4b", "indicator--f59f91cf-6838-42bc-b9bf-f2c291d3ef6c", "indicator--22809f1a-7b9f-403c-94b4-fff3b9f57a6e", "indicator--ffc374db-3354-4109-8dd9-04edc328181f", "indicator--08db76a9-e5bc-4184-a95e-ff595f850870", "indicator--13717a44-6004-4c9e-9d23-9af3ffdae08a", "indicator--f0c23532-5c2a-455c-a0a4-a9e33590d40e", "indicator--35a4c05c-23d0-4b2a-9a67-006aa7d95a7b", "indicator--24f4d95f-b726-45a2-9a91-b240a78bf565", "indicator--0883cce8-6584-4519-aa35-2042258705df", "indicator--693355bb-483d-44a6-b8a5-4d92f08d8ecd", "indicator--f90bc918-bf73-4eab-8035-16926337f8d0", "indicator--0bd110d5-72c1-4f09-a716-dc3a1081c2b1", "indicator--074e4969-d31d-4438-843c-854c9c5404ed", "indicator--707d8218-67b6-4160-99ec-0432fcff2f60", "indicator--677a2ace-de0c-49e9-bb9a-c29740dc5773", "indicator--dc969898-d360-452e-b587-e7f534c01f50", "indicator--23b87217-bfed-4c6d-8971-63886e5c1b74", "indicator--9f1a5cc2-06c8-407d-9517-a51af4f41a9a", "indicator--fad25a72-a276-4be7-a87b-da493525e95a", "indicator--32d8aa2e-e036-423f-ab19-6e424508735e", "indicator--49fb29ef-184e-407d-9011-1814a678c5c1", "indicator--9ff0b524-ce1d-4b74-a81e-67d1c5d9e401", "indicator--79a5225f-bee2-46bd-853e-941920819710", "indicator--83f4c8d2-a668-4c4a-bd9c-fd75fd66c988", "indicator--7bf6836b-5cfe-462c-8736-ed4da446bf42", "indicator--3392d9d2-a22e-428c-8fc1-10852ffacca0", "indicator--3e7d3f74-1c4b-43d7-b222-39e97b3c588d", "indicator--e323600f-cffe-4b83-a0b1-e1fd38303cea", "indicator--7bcdafff-4c3b-4f95-9f53-d403668db77b", "indicator--aaec2f1c-2d4b-4ec9-ae0d-8a55313bc3d4", "indicator--37de9c13-1b3f-4bf7-ba8b-478dd93f609b", "indicator--ca23514f-0438-4340-a088-4fc626d0ac6b", "indicator--948b7b31-a688-4630-b2ca-0b729ea1efc9", "indicator--042f6e55-1fd7-455a-8f2e-bec59b8d9351", "indicator--f37cdb14-9079-465b-909c-a16d7ea23e64", "indicator--22746f82-3435-4104-bd3f-2f59826eb9cf", "indicator--72d27317-3f73-49d2-ab3e-2b31b875d953", "indicator--3d09aa28-d4c5-4dd7-8634-7769c0bc38e8", "indicator--39fa98d8-3dc2-4ddc-9950-4f580d08f6ee", "indicator--b95140f0-a433-4726-b6e0-59834ffa5511", "indicator--26f41690-9913-4674-856f-87c029487036", "indicator--a9aa5e28-bebc-4440-8563-aeda53460265" ], "external_references": [ { "source_name": "TI Mindmap HUB", "url": "https://ti-mindmap-hub.com/analytics/agentic-ai-attack-wave-cross-source-analysis" } ] }, { "type": "indicator", "id": "indicator--fcc6e4f1-393f-43d9-b7a0-e89cb5bafdf2", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 144.172.64[.]99", "description": "IPv4 | Password spray 10 to 14 Oct; Okta abuse | High | [#13][#17]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '144.172.64.99']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--c4e792ce-d211-4a06-b605-4742a103fe8f", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 144.172.64[.]60", "description": "IPv4 | Storm-0940 sign-ins and Graph activity | High | [#13][#14]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '144.172.64.60']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--d690629e-c8a0-420d-9b08-bce9600b269e", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 144.172.64[.]128", "description": "IPv4 | Entra sign-ins across about 1,000 tenants | High | [#17][#19]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '144.172.64.128']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--3779f2dc-89c6-4710-9c34-d30af34afbef", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 187.15.88[.]186", "description": "IPv4 | VPN addresses seen 15 to 16 Oct; context needed | Medium | [#13]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '187.15.88.186']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--add24405-feb0-4ac0-bcfb-1599e0f742d3", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 187.15.90[.]217", "description": "IPv4 | VPN addresses seen 15 to 16 Oct; context needed | Medium | [#13]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '187.15.90.217']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--bef24097-b524-460d-abb2-efb5b0aa3987", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 187.15.89[.]186", "description": "IPv4 | VPN addresses seen 15 to 16 Oct; context needed | Medium | [#13]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '187.15.89.186']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--3a7a905a-5b88-456c-ae66-6c19d87fd7e6", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 104.194.150[.]21", "description": "IPv4 | Reported with the campaign by Wiz | Low | [#14]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '104.194.150.21']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--da5211ca-3e75-4010-b584-73568612936d", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 167.88.172[.]97", "description": "IPv4 | Reported with the campaign by Wiz | Low | [#14]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '167.88.172.97']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--9f6bc23a-9924-4dc2-abc3-b6e8e03b869c", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 194.165.16[.]21", "description": "IPv4 | Possibly related; reused python-requests/2.31 | Low | [#19]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.165.16.21']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-0940, ConnectWise and ARTEX identity attacks" ] }, { "type": "indicator", "id": "indicator--959e87ec-950c-4c82-aa65-0e4cf4d8cc0a", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 38.244.50[.]120", "description": "IPv4 | ARTEX jump server (Korean banks); open directory on port 18899 | High | [#15][#29]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '38.244.50.120']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--e8b0f6a7-f4df-490a-9e7d-84bfa5bf21d1", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 23.248.226[.]250", "description": "IPv4 | Work servers of the same operator | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.248.226.250']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--640feef6-b9c2-4be8-80a1-a7537c52c09e", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 23.248.226[.]251", "description": "IPv4 | Work servers of the same operator | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.248.226.251']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--d4b7cb0a-25b6-4fb8-a12a-4470ac9d8195", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 23.248.226[.]252", "description": "IPv4 | Work servers of the same operator | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.248.226.252']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--652f82df-48fd-4f0e-8511-56e29923f7e3", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 23.248.226[.]253", "description": "IPv4 | Work servers of the same operator | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.248.226.253']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--708526be-ed2a-457e-9937-0615a1fd3af0", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 23.248.226[.]254", "description": "IPv4 | Work servers of the same operator | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.248.226.254']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--30b1cc86-cadc-432f-a9e9-5b5097322a5f", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 154.201.79[.]246", "description": "IPv4 | Proxy pool API and SOCKS proxies | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '154.201.79.246']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--1ebdc503-eefd-4638-86cf-4eb413c3ac22", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 205.214.59[.]31", "description": "IPv4 | Proxy pool API and SOCKS proxies | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '205.214.59.31']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--7428c35d-8dab-4916-87e0-88b9d836cfbb", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 161.8.161[.]140", "description": "IPv4 | Proxy pool API and SOCKS proxies | Medium | [#15]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '161.8.161.140']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--9a9b3331-146e-403a-9373-3f781ea39d74", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: xcai[.]pro", "description": "Domain | LLM API reseller used by ARTEX | Medium | [#15][#29]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'xcai.pro']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--85b6c725-c699-4589-a78d-2c140e844018", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 31.40.205[.]155", "description": "IPv4 | ARTEX realm and Sub2API gateway; two victims | Medium | [#23]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '31.40.205.155']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--0e9a641b-acc7-4ecd-9957-132eda74a317", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 173.254.220[.]78", "description": "IPv4 | ARTEX realm and Sub2API gateway; two victims | Medium | [#23]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '173.254.220.78']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--1ebb75c2-361e-4141-a442-4ded97e3bdbb", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 103.100.158[.]103", "description": "IPv4 | Probing and unauthenticated API writes; monitor | Low | [#23]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '103.100.158.103']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--77786156-4cbb-46d4-bc35-4802c22ebb0a", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 152.233.51[.]12", "description": "IPv4 | Probing and unauthenticated API writes; monitor | Low | [#23]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '152.233.51.12']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--83bf591c-69c1-4ac5-86bc-78a9a2c0c39d", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: lanmao666[.]com", "description": "Domain | AI gateway pivots; relation to operators uncertain | Low | [#23]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'lanmao666.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--27b670c5-9902-4428-a4e8-f413e77f3715", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: lanmao666[.]xyz", "description": "Domain | AI gateway pivots; relation to operators uncertain | Low | [#23]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'lanmao666.xyz']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--14dc2465-0bf6-4142-b45d-bef8b4696180", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 169.128.55[.]214", "description": "IPv4 | ARTEX against AWS (Cognito and keys) | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '169.128.55.214']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--67a1cf54-4d98-47d4-ac6e-15a7bd8c5c99", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 154.64.252[.]77", "description": "IPv4 | ARTEX against AWS (Cognito and keys) | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '154.64.252.77']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--7697377c-9cc5-45ff-bec1-a7139b98acb0", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 154.36.136[.]197", "description": "IPv4 | ARTEX against AWS (Cognito and keys) | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '154.36.136.197']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--09c71c16-5e38-455e-bf6e-3bf3d4d620be", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 154.36.136[.]23", "description": "IPv4 | ARTEX against AWS (Cognito and keys) | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '154.36.136.23']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--72e2c8bc-1cb1-4ec7-bd9f-40c9b0284572", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 102.216.154[.]102", "description": "IPv4 | ARTEX against AWS (Cognito and keys) | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '102.216.154.102']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--8b7db7ab-6e9d-442a-b2a6-32639decb8a7", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 82.158.88[.]233", "description": "IPv4 | ARTEX against AWS | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '82.158.88.233']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--ef04b725-7fae-4c1c-bfff-d3bf4662eea7", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 88.229.22[.]232", "description": "IPv4 | ARTEX against AWS | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '88.229.22.232']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--a29e160f-315d-45c2-957d-bcb654b28068", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 103.54.154[.]40", "description": "IPv4 | ARTEX against AWS | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '103.54.154.40']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--b24cdfd8-d215-462a-a832-dcc9253f24c2", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 103.54.154[.]32", "description": "IPv4 | ARTEX against AWS | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '103.54.154.32']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--2bf889cc-564c-4e78-bd74-ff0b849ba46b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 45.145.228[.]25", "description": "IPv4 | ARTEX against AWS | Medium | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.145.228.25']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--03240a43-5c49-4953-96f8-854ebbac2581", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: zeofast[.]cn", "description": "Domain | Linked to ARTEX AWS activity | Low | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'zeofast.cn']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--a554742a-6d3d-4f9f-927b-759da489bba6", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: yecaoyun[.]com", "description": "Domain | Linked to ARTEX AWS activity | Low | [#30]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'yecaoyun.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--92ea76e9-997e-43fc-a0fc-e66c4f8d707f", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 199.19.77[.]84", "description": "IPv4 | Primary campaign IP for stolen secrets; block for workload identities | High | [#27]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '199.19.77.84']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--99697131-25b0-4657-9c7f-3f9a74564cef", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 199.19.77[.]18", "description": "IPv4 | Tor exit; command-injection user agent; Azure AI recon | Low | [#27]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '199.19.77.18']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--cb42cea3-8b03-4981-93d9-bb6e7634c19d", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 65.87.223[.]26", "description": "IPv4 | Tor exit; command-injection user agent; Azure AI recon | Low | [#27]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '65.87.223.26']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--b5822d2f-1fc3-4cca-944b-4ccbe50831a6", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 157.22.126[.]128", "description": "IPv4 | Tor exit; command-injection user agent; Azure AI recon | Low | [#27]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '157.22.126.128']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "ARTEX operators, infrastructure and cloud abuse" ] }, { "type": "indicator", "id": "indicator--ce8d0aa3-d3ea-49a5-913e-3def99904f41", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 199.19.95[.]66", "description": "IPv4 | WISP C2, first seen 2 Nov | High | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '199.19.95.66']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--a570d6fc-c89a-41d8-ae35-cfc49f98bf31", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 199.19.95[.]67", "description": "IPv4 | WISP C2, first seen 2 Nov | High | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '199.19.95.67']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--a1466c03-89db-4688-87ea-efa1ae5b8732", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 199.19.95[.]68", "description": "IPv4 | WISP C2, first seen 2 Nov | High | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '199.19.95.68']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--82bdd3ea-f1ce-40e2-856a-a405ce2e8786", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 91.92.240[.]238", "description": "IPv4 | ARTEX servers; Microsoft query lists 178.15.54[.]129, verify both | Medium | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.92.240.238']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--acd57b8c-0ff7-4741-87fd-525ffca9038c", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 85.11.168[.]45", "description": "IPv4 | ARTEX servers; Microsoft query lists 178.15.54[.]129, verify both | Medium | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '85.11.168.45']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--5eaacc1b-2e2c-45a3-a600-604acaeb23cb", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 178.16.54[.]129", "description": "IPv4 | ARTEX servers; Microsoft query lists 178.15.54[.]129, verify both | Medium | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '178.16.54.129']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--43e6ab22-4b99-4b5c-8645-cb434c3dcf72", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 31.77.229[.]35", "description": "IPv4 | ARTEX servers; Microsoft query lists 178.15.54[.]129, verify both | Medium | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '31.77.229.35']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--9aec9595-0e29-49f3-9a4b-fb0878a1e04e", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 178.15.54[.]129", "description": "IPv4 | 91.92.240[.]238, 85.11.168[.]45, 178.16.54[.]129, 31.77.229[.]35 | Medium | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '178.15.54.129']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--b9c10ed6-b575-4ba8-8869-65983fb40147", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 85.11.167[.]52", "description": "IPv4 | C2 server first seen 4 Nov | Medium | [#28]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '85.11.167.52']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--120f2f4f-9399-4482-b7c9-3197b4d30433", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: nginxmysql[.]com", "description": "Domain | BLOODALCHEMY C2 | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'nginxmysql.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--b6ee69cc-df72-4c61-841a-c07ce6043914", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: sqlserver-sqlite[.]com", "description": "Domain | BLOODALCHEMY C2 | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sqlserver-sqlite.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--b994c5ad-daaa-4739-85f7-8c82553f61c4", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: www.ddduuuppp[.]com", "description": "Domain | BLOODALCHEMY C2 | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'www.ddduuuppp.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--f1bb6fc8-5bb8-4e72-8810-dbf94caca24f", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 45.153.126[.]223", "description": "IPv4 | Resolutions of the three C2 domains | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.153.126.223']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--1f99e3d7-ab38-4544-8815-a78255605b75", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 89.46.234[.]50", "description": "IPv4 | Resolutions of the three C2 domains | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '89.46.234.50']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--852d750b-885c-4e76-b5ac-41078765e1a5", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 192.121.47[.]20", "description": "IPv4 | Resolutions of the three C2 domains | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '192.121.47.20']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--684b47ee-aac5-43f6-8f9a-ced883b95822", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068", "description": "SHA-256 | Legitimate GameHook renamed svchost.exe | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--17d12164-048b-41a5-9c1a-fbaa2dbac298", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4", "description": "SHA-256 | Loader graphics-hook-filter64.dll | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--c7baa264-0b8b-4d74-8e67-862e3f97b2ef", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab", "description": "SHA-256 | Payload graphics-hook_config.bin | High | [#25]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Storm-3358 and VAPOR PANDA" ] }, { "type": "indicator", "id": "indicator--16b038ee-abfb-4e17-854a-95b84946e431", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573", "description": "SHA-256 | Malicious /app/artex binary | High | [#32]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'd5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--b11fbef4-3065-44d5-90a1-13c0eb1a7ee9", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: www.litellm[.]dev", "description": "Domain | LiteLLM stealer exfiltration (/healthcheck) | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'www.litellm.dev']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--216548c6-7165-464f-be2f-53eb77e720d6", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 168.100.8[.]57", "description": "IPv4 | Post-exploitation with stolen AWS role credentials | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '168.100.8.57']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--368038da-9fdc-40b8-8ff9-94e86a4f8667", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 165.227.201[.]8", "description": "IPv4 | Post-exploitation with stolen AWS role credentials | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '165.227.201.8']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--cd5f1ecb-3a1b-47d7-83fc-9c0faab079a1", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d", "description": "SHA-256 | cook.pth (Windows) | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--05c1f32f-6409-4879-9c83-d65e3a89cccf", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb", "description": "SHA-256 | cook.pth (Linux, macOS) | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--f6287848-23e5-4fcd-b676-db46019b48d8", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea", "description": "SHA-256 | cook.py (Windows) | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--a978ed35-98bb-43ba-a189-a766b7e4f6f8", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25", "description": "SHA-256 | cook.py (Linux, macOS) | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--d66faf33-2227-4a7e-9675-064db590be3b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465", "description": "SHA-256 | sitecustomize.py (Windows) | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--dc09fec1-99c7-438b-8e97-10410e5b0ad9", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa", "description": "SHA-256 | sitecustomize.py (Linux, macOS) | High | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--e93df0b0-8b36-48c5-8fd1-0937e28f56b8", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 23.106.46[.]239", "description": "IPv4 | Checked stolen Bedrock keys; resale infrastructure | Medium | [#21]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.106.46.239']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--b18aaa26-a0a9-4911-9549-f77250f94c68", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 38.246.114[.]118", "description": "IPv4 | Checked stolen Bedrock keys; resale infrastructure | Medium | [#21]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '38.246.114.118']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--838e7bb7-9aed-4dd6-b84d-099587373ecd", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 104.243.32[.]50", "description": "IPv4 | Checked stolen Bedrock keys; resale infrastructure | Medium | [#21]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '104.243.32.50']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--f7b3bf27-4030-4ff3-9fa2-27d9922a3835", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 31.57.201[.]201", "description": "IPv4 | Checked stolen Bedrock keys; resale infrastructure | Medium | [#21]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '31.57.201.201']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--ac991173-5242-42e7-9308-e2427b4c8b5b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: llm-routing[.]com", "description": "Domain | LLM resale services; context needed | Medium | [#21]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'llm-routing.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--b023ccff-ce78-4fe2-bea1-8ef25360adf6", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: xingjiabiapi[.]org", "description": "Domain | LLM resale services; context needed | Medium | [#21]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'xingjiabiapi.org']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--0f1c6f1b-0099-4d54-8370-51e3a152fb22", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: momo[.]skin", "description": "Domain | LLM resale services; context needed | Medium | [#21]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'momo.skin']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Trojanized ARTEX image and AI-infrastructure supply chain" ] }, { "type": "indicator", "id": "indicator--ac182ea8-5ed1-4d52-80ff-5252e4497f59", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 152.236.4[.]14", "description": "IPv4 | Aur0ra exfiltration, S3-compatible port 54410 | High | [#20]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '152.236.4.14']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--2922cf1d-1ec5-4706-a989-5fc108ebad6c", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 152.236.3[.]8", "description": "IPv4 | GOLD OGRE Cobalt Strike C2 | High | [#20]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '152.236.3.8']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--deb0324d-1cee-48b2-a1bf-1e109604d8e1", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 172.86.89[.]124", "description": "IPv4 | GOLD OGRE Cobalt Strike C2 | High | [#20]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '172.86.89.124']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--14b2895a-7ea3-4fbb-9995-ecdd4adfb9b4", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 144.172.101[.]72", "description": "IPv4 | GOLD OGRE Cobalt Strike C2 | High | [#20]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '144.172.101.72']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--8fa3173a-97e9-4a15-90c2-fe6c7d1bc405", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 206.223.230[.]107", "description": "IPv4 | GOLD OGRE Cobalt Strike C2 | High | [#20]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '206.223.230.107']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--c6cfff09-0eeb-44c2-a98f-5af343d76695", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 45.59.113[.]63", "description": "IPv4 | SOCKS node; exposed open directory | Medium | [#20]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.59.113.63']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--8fdfdab7-4fdb-4c4a-9d24-95c7de1a2804", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 172.86.113[.]245", "description": "IPv4 | SOCKS node; exposed open directory | Medium | [#20]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '172.86.113.245']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--63246ced-0ab9-4899-b152-1d36fa6e138f", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 217.156.122[.]129", "description": "IPv4 | BlackHatSect0r C2 (active, retired) | High | [#10]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '217.156.122.129']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--dd849ca2-dbd6-439c-88f2-83d272e993f7", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 37.221.66[.]43", "description": "IPv4 | BlackHatSect0r C2 (active, retired) | High | [#10]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '37.221.66.43']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--8fe7606b-0cdc-4225-bdf2-4d8cbcfb052f", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 154.217.251[.]226", "description": "IPv4 | Flowise attacker callback host | High | [#26]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '154.217.251.226']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--a908dbdb-8372-4231-b83f-91d093755993", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "url: hxxp://154.217.251[.]226:19999/flowise-hb", "description": "URL | Malicious Flowise workflow callback | High | [#26]", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://154.217.251.226:19999/flowise-hb']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Other ransomware, crime and agent-runtime campaigns" ] }, { "type": "indicator", "id": "indicator--c9c2034b-a388-4962-b92a-ddd6e4c994ea", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 45.131.66[.]106", "description": "IPv4 | Storm-3168 App Service probing and ARM requests | High | [#8]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.131.66.106']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--1f0f9f12-4dc0-46f7-ad1d-43b2021017ea", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 34.153.223[.]102", "description": "IPv4 | Storm-3168 App Service probing and ARM requests | High | [#8]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '34.153.223.102']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--4485ee22-3015-4c79-a63a-50c1e58581b9", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 64.20.53[.]230", "description": "IPv4 | Storm-3168 App Service probing and ARM requests | High | [#8]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '64.20.53.230']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--de038752-934c-4c5b-ace5-25a8d9faf896", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 45.79.183[.]61", "description": "IPv4 | CARBONATO C2, earlier C2, beacon and reverse shell | High | [#7]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.79.183.61']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--79383494-c2ce-4fe2-b966-00b97ca5f7d0", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 91.99.195[.]164", "description": "IPv4 | CARBONATO C2, earlier C2, beacon and reverse shell | High | [#7]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.99.195.164']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--eb9af709-8558-42cd-9a91-903fb8641f47", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 213.136.79[.]115", "description": "IPv4 | CARBONATO C2, earlier C2, beacon and reverse shell | High | [#7]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '213.136.79.115']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--f87ac36e-900a-4bb4-8fdc-db42b36bcdea", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 213.136.83[.]197", "description": "IPv4 | CARBONATO LLM gateway; Costa Rica SSH tunnel sink | High | [#7]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '213.136.83.197']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--5acc6f88-1545-4a04-8df2-7dac5e411cc3", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "ipv4: 190.211.124[.]187", "description": "IPv4 | CARBONATO LLM gateway; Costa Rica SSH tunnel sink | High | [#7]", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '190.211.124.187']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--25b89f92-b7bf-4042-9117-82a78e4c4423", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: static-js[.]com", "description": "Domain | Retail card-skimmer host | High | [#9]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'static-js.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--f8fbeeff-b491-4154-a643-f2ccf8657175", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "url: hxxps://static-js.com/js/nrt[.]js", "description": "URL | Card-skimming payload | High | [#9]", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://static-js.com/js/nrt.js']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--b9d46a2a-deaa-493e-9bb8-cc7f7c5e5969", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "url: hxxps://openrouter[.]ai/api/v1/chat/completions", "description": "URL | Neural Override LLM planning; legitimate service, context needed | Medium | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://openrouter.ai/api/v1/chat/completions']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--ebed013e-4276-4adc-b46a-8a7b2b38b310", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: api.telegram[.]org", "description": "Domain | Telegram C2; legitimate service, context needed | Medium | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'api.telegram.org']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--6c95ca3d-a3ee-4d19-9c6e-772f6c101968", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 7eb8b6b1b5934a5f1011320c27a25e30d69c76a8a338a42b74eeccb04080e06e", "description": "SHA-256 | Neural Override Build 1 | High | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '7eb8b6b1b5934a5f1011320c27a25e30d69c76a8a338a42b74eeccb04080e06e']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--ea616b63-0d73-4d1d-bb01-1b5771293e6b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: e7c63a717539e2c78a1600dbb69ce0c48d9707832c8a747e9d211a6a711b1cd9", "description": "SHA-256 | Build 2 (OpenRouter introduced) | High | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'e7c63a717539e2c78a1600dbb69ce0c48d9707832c8a747e9d211a6a711b1cd9']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--688cd94c-abaa-4193-988e-31e6f2778d4b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: cee0bc699073dbcf97b68e05110a29503b844748bcd2492cbae0f6882a3775e0", "description": "SHA-256 | Build 3 (Python source, SCADA tasking) | High | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'cee0bc699073dbcf97b68e05110a29503b844748bcd2492cbae0f6882a3775e0']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--f59f91cf-6838-42bc-b9bf-f2c291d3ef6c", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: fb9abe6285fc0152b35673b36a5fbf1893bf8592fac7e352357ab4bdeccd67f1", "description": "SHA-256 | Build 4 (compiled, 61 capabilities) | High | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'fb9abe6285fc0152b35673b36a5fbf1893bf8592fac7e352357ab4bdeccd67f1']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--22809f1a-7b9f-403c-94b4-fff3b9f57a6e", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "sha256: 5138f443dfd519c77adcfc1f86821cd1821a558e3e2c5a09b9cc6aab84639657", "description": "SHA-256 | Build 5 (rollback to v3) | High | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '5138f443dfd519c77adcfc1f86821cd1821a558e3e2c5a09b9cc6aab84639657']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "September campaigns (carried over)" ] }, { "type": "indicator", "id": "indicator--ffc374db-3354-4109-8dd9-04edc328181f", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: corpaccountbook[.]link", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'corpaccountbook.link']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--08db76a9-e5bc-4184-a95e-ff595f850870", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: execcoachdirecpro[.]click", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'execcoachdirecpro.click']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--13717a44-6004-4c9e-9d23-9af3ffdae08a", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: corplegalassistdoc[.]pro", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'corplegalassistdoc.pro']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--f0c23532-5c2a-455c-a0a4-a9e33590d40e", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: careergrwostep[.]top", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'careergrwostep.top']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--35a4c05c-23d0-4b2a-9a67-006aa7d95a7b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: energyrecruitpro[.]pro", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'energyrecruitpro.pro']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--24f4d95f-b726-45a2-9a91-b240a78bf565", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: balanceaccounting[.]info", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'balanceaccounting.info']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--0883cce8-6584-4519-aa35-2042258705df", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: strategeconaware[.]info", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'strategeconaware.info']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--693355bb-483d-44a6-b8a5-4d92f08d8ecd", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: notarycertverify[.]pro", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'notarycertverify.pro']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--f90bc918-bf73-4eab-8035-16926337f8d0", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: microservicebiz[.]forum", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'microservicebiz.forum']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--0bd110d5-72c1-4f09-a716-dc3a1081c2b1", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: ledcovilco[.]tech", "description": "Domain | Ad-review injection | High | [#6]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ledcovilco.tech']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--074e4969-d31d-4438-843c-854c9c5404ed", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: ahorranitides[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ahorranitides.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--707d8218-67b6-4160-99ec-0432fcff2f60", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: alzafondavikk-aibot[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'alzafondavikk-aibot.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--677a2ace-de0c-49e9-bb9a-c29740dc5773", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: antenoinvexabot[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'antenoinvexabot.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--dc969898-d360-452e-b587-e7f534c01f50", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: bitgrokesai[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bitgrokesai.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--23b87217-bfed-4c6d-8971-63886e5c1b74", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: boundmerit[.]digital", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'boundmerit.digital']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--9f1a5cc2-06c8-407d-9517-a51af4f41a9a", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: candordividholdenai[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'candordividholdenai.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--fad25a72-a276-4be7-a87b-da493525e95a", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: capivelleaibot[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'capivelleaibot.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--32d8aa2e-e036-423f-ab19-6e424508735e", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: cevsterflax-ai[.]uk", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cevsterflax-ai.uk']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--49fb29ef-184e-407d-9011-1814a678c5c1", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: degisoreth[.]live", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'degisoreth.live']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--9ff0b524-ce1d-4b74-a81e-67d1c5d9e401", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: fathomtally-bot[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'fathomtally-bot.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--79a5225f-bee2-46bd-853e-941920819710", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: firmwealthgroveai[.]net", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'firmwealthgroveai.net']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--83f4c8d2-a668-4c4a-bd9c-fd75fd66c988", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: floridenz-ch[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'floridenz-ch.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--7bf6836b-5cfe-462c-8736-ed4da446bf42", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: infobasedomain[.]click", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'infobasedomain.click']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--3392d9d2-a22e-428c-8fc1-10852ffacca0", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: ntidahaberoria-aibot[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ntidahaberoria-aibot.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--3e7d3f74-1c4b-43d7-b222-39e97b3c588d", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: nullyptoaibot[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'nullyptoaibot.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--e323600f-cffe-4b83-a0b1-e1fd38303cea", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: oniontestprodomain[.]click", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'oniontestprodomain.click']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--7bcdafff-4c3b-4f95-9f53-d403668db77b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: opentraderaica[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'opentraderaica.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--aaec2f1c-2d4b-4ec9-ae0d-8a55313bc3d4", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: oxlyraibot[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'oxlyraibot.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--37de9c13-1b3f-4bf7-ba8b-478dd93f609b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: quellrendoire-ai[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'quellrendoire-ai.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--ca23514f-0438-4340-a088-4fc626d0ac6b", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: sfromiledra-es[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sfromiledra-es.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--948b7b31-a688-4630-b2ca-0b729ea1efc9", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: sfrundamolu-ai[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sfrundamolu-ai.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--042f6e55-1fd7-455a-8f2e-bec59b8d9351", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: solidwarranture-ai[.]uk", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'solidwarranture-ai.uk']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--f37cdb14-9079-465b-909c-a16d7ea23e64", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: templavaliaai[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'templavaliaai.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--22746f82-3435-4104-bd3f-2f59826eb9cf", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: treuvermostein-ch[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'treuvermostein-ch.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--72d27317-3f73-49d2-ab3e-2b31b875d953", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: turbrelaytrx-ai-es[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'turbrelaytrx-ai-es.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--3d09aa28-d4c5-4dd7-8634-7769c0bc38e8", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: valuenticeau[.]com", "description": "Domain | Fake trading platforms with hidden injection | High | [#34]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'valuenticeau.com']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Prompt-injection domains" ] }, { "type": "indicator", "id": "indicator--39fa98d8-3dc2-4ddc-9950-4f580d08f6ee", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: autorun[.]inf", "description": "File, registry | Neural Override persistence and USB spread | [#5]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'autorun.inf']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Host artifacts and behavioral indicators" ] }, { "type": "indicator", "id": "indicator--b95140f0-a433-4726-b6e0-59834ffa5511", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: cook[.]pth", "description": "File | LiteLLM 1.107.0 stealer | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cook.pth']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Host artifacts and behavioral indicators" ] }, { "type": "indicator", "id": "indicator--26f41690-9913-4674-856f-87c029487036", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: cook[.]py", "description": "File | LiteLLM 1.107.0 stealer | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cook.py']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Host artifacts and behavioral indicators" ] }, { "type": "indicator", "id": "indicator--a9aa5e28-bebc-4440-8563-aeda53460265", "spec_version": "2.1", "created": "2026-11-12T00:00:00.000Z", "modified": "2026-11-12T00:00:00.000Z", "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "domain: sitecustomize[.]py", "description": "File | LiteLLM 1.107.0 stealer | [#16]", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sitecustomize.py']", "pattern_type": "stix", "valid_from": "2026-11-12T00:00:00.000Z", "labels": [ "Host artifacts and behavioral indicators" ] } ] }