{
  "type": "bundle",
  "id": "bundle--0acf8e3c-6009-4a53-99cb-e1d33cd8225a",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "created": "2024-01-01T00:00:00.000Z",
      "modified": "2024-01-01T00:00:00.000Z",
      "name": "TI Mindmap HUB",
      "identity_class": "organization"
    },
    {
      "type": "report",
      "id": "report--ef4c7e45-19b9-48b1-a441-5ca13c8c7fbb",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ARTEX Agentic Offensive Framework: Architecture, Fork Ecosystem, and Multi-Actor Abuse",
      "description": "How the ARTEX agentic AI framework operates, proliferated via 12,000+ forks and a backdoored Docker image, and is abused by state and criminal actors.",
      "report_types": [
        "threat-report"
      ],
      "published": "2026-11-13T00:00:00.000Z",
      "object_refs": [
        "indicator--b87ca7eb-65af-4d9c-b8a4-0b1a2077b76b",
        "indicator--db682ea2-bdf3-4825-b8b7-81c97319a530",
        "indicator--8fb435f0-4aee-49df-a425-554864b6fe3c",
        "indicator--756a559d-3794-4ce3-a35a-e41fc5324b65",
        "indicator--5ef0dd99-e62a-49ef-84bd-d44b5481b8ac",
        "indicator--eee08da9-ffce-45e1-becd-b8df10010828",
        "indicator--aa6284e3-0a5d-4106-86f6-5f9005f47c87",
        "indicator--bbf4b8ab-1910-4647-a0dc-8d9bea04ef26",
        "indicator--21cd600a-ef28-4e64-adfd-1de253fcd677",
        "indicator--9f0407eb-3424-4e45-a3aa-3ca8cef32b5a",
        "indicator--aa839907-e0e6-4949-9925-9c6e9752d37d",
        "indicator--87578d4e-e6c2-4c6b-95ea-732fe881b263",
        "indicator--aed7db9c-ff12-44da-9dd0-24caab754f47",
        "indicator--c4560722-ba45-4e3e-8e02-617bf40650b6",
        "indicator--cf34d6eb-dd2f-4900-8f01-2ed5221ea0dc",
        "indicator--294d50b5-a665-4b70-ba2c-34b459a416b8",
        "indicator--d23ceae5-3892-4009-b17d-c5c0bc32b1a9",
        "indicator--1fc39da1-ba86-4a52-a520-4b3b6f2eeee6",
        "indicator--bbd79d44-3129-49b6-9283-55c49ca7ea47",
        "indicator--52762965-e1eb-4159-ad00-178ce71b3396",
        "indicator--09d684bb-6be0-4b4e-bbc5-37c2356994c8",
        "indicator--b6c37b51-88b8-4572-8d08-5297e1186e59",
        "indicator--2fdf75a4-6b60-4adc-b045-7315687301e3",
        "indicator--aa49fe25-a636-4f40-a2d9-bb5fcd030dc1",
        "indicator--9a0fe0da-27ae-4541-b448-594e0dcff07b",
        "indicator--dbe97781-7e79-4d9a-8e08-2b3ffe5b6d44",
        "indicator--8345abf6-7603-4e43-bdd3-8579a1525aa9",
        "indicator--924dca3e-5b80-4df7-a143-502954ddd567",
        "indicator--4ea1ed81-61eb-4b7a-b918-dcf47ad960ad",
        "indicator--b5c19b4f-ca36-4b91-a6e5-2d459ba9370f",
        "indicator--ba938735-172b-467d-9250-ab8920b417ab",
        "indicator--4d30a663-c68f-4520-b52f-547bf6fa6aa1",
        "indicator--7bb3739d-eea5-428f-96dc-c38a7621914f",
        "indicator--2a05b178-c2c2-4442-b2c1-fc18eaa24aa2",
        "indicator--6e01f070-97d3-413e-91e0-a5b829ddb44e",
        "indicator--96fe91f7-0f0b-423a-add6-9e53f5106244",
        "indicator--f33b1fcc-976a-452c-8e8c-cb1688926bda",
        "indicator--05b53c4e-3383-4a4f-b031-4639a9755895",
        "indicator--fffd5f20-6c59-489e-af7e-5aec2d2bcecf",
        "indicator--3f1194db-0d7a-4962-9bed-e951c3e5268e",
        "indicator--1d69ffee-f74e-496b-807f-65bfaeb3c541",
        "indicator--f81be7ed-686b-4f67-8568-c989822c99f2",
        "indicator--1e580a78-c18f-45de-84af-bfc960db657c",
        "indicator--48237101-57ed-4975-b60c-1ed5d10c1c2d",
        "indicator--d40ace3f-6f7b-4f38-969b-20d7ecedba1f",
        "indicator--cbd03ac7-4937-4da6-be9e-1629b653c575",
        "indicator--a147617b-55b6-4e8d-9327-1ccd464b29e8",
        "indicator--029d906b-8c81-492e-a9de-cf6c944a77ab",
        "indicator--1b125124-8d4a-499f-8cda-caae87541ced",
        "indicator--bc10d733-431d-4894-b6db-eb7c9d9883de",
        "indicator--7039560c-666b-4959-8e01-df87c9aff581",
        "indicator--7e47c856-bdda-41a4-ab39-87b9b59fdebf",
        "indicator--c0b50ca3-071a-419a-a79d-363b0fd58788",
        "indicator--dc0c79d9-f7e6-45e0-a345-44dbb793fa91",
        "indicator--9dbc2138-2b5a-4815-b397-d91a86d8f02a",
        "indicator--721d48d1-91e6-4007-9f9f-b061c2eee377",
        "indicator--35e3e94a-76dc-48b4-9ccf-1de4ac0b7df0",
        "indicator--7a38714b-639f-46ae-9d00-20c626166913",
        "indicator--ec9b360c-885f-4bfa-be1b-d46fb5f235ea",
        "indicator--7db8c413-b59e-4ae6-aae9-cc6a84fef8e4",
        "indicator--b1735023-30e4-4641-a5fd-8f88ee45e805",
        "indicator--22b0a07a-92f6-4f72-913b-c62e565647c6",
        "indicator--5a6b8e0b-7b3e-4886-ac88-74eeba3428f3",
        "indicator--d966c892-d861-4671-a024-564edd9ab6fa",
        "indicator--5b1796ba-e53d-4f13-8499-eddf227a23d7",
        "indicator--f115fd07-bf99-4297-934b-2f47cd78a6d3",
        "indicator--742d1c74-000b-4e8d-b9ef-fc2ef57823fb"
      ],
      "external_references": [
        {
          "source_name": "TI Mindmap HUB",
          "url": "https://ti-mindmap-hub.com/analytics/artex-agentic-offensive-framework"
        }
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--b87ca7eb-65af-4d9c-b8a4-0b1a2077b76b",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: nginxmysql[.]com",
      "description": "Domain | BLOODALCHEMY C2 domains | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'nginxmysql.com']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--db682ea2-bdf3-4825-b8b7-81c97319a530",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: sqlserver-sqlite[.]com",
      "description": "Domain | BLOODALCHEMY C2 domains | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'sqlserver-sqlite.com']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--8fb435f0-4aee-49df-a425-554864b6fe3c",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: www.ddduuuppp[.]com",
      "description": "Domain | BLOODALCHEMY C2 domains | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'www.ddduuuppp.com']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--756a559d-3794-4ce3-a35a-e41fc5324b65",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 45.153.126[.]223",
      "description": "IPv4 | Resolutions for the three BLOODALCHEMY C2 domains | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '45.153.126.223']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--5ef0dd99-e62a-49ef-84bd-d44b5481b8ac",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 89.46.234[.]50",
      "description": "IPv4 | Resolutions for the three BLOODALCHEMY C2 domains | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '89.46.234.50']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--eee08da9-ffce-45e1-becd-b8df10010828",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 192.121.47[.]20",
      "description": "IPv4 | Resolutions for the three BLOODALCHEMY C2 domains | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '192.121.47.20']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--aa6284e3-0a5d-4106-86f6-5f9005f47c87",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068",
      "description": "SHA-256 | Legitimate GameHook binary renamed svchost.exe for DLL sideloading | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--bbf4b8ab-1910-4647-a0dc-8d9bea04ef26",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4",
      "description": "SHA-256 | graphics-hook-filter64.dll (BLOODALCHEMY loader DLL) | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--21cd600a-ef28-4e64-adfd-1de253fcd677",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab",
      "description": "SHA-256 | graphics-hook_config.bin (encrypted BLOODALCHEMY payload) | High | [#4]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--9f0407eb-3424-4e45-a3aa-3ca8cef32b5a",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 199.19.95[.]66",
      "description": "IPv4 | WISP RAT C2 nodes (active 2026-11-02 to 11-06) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '199.19.95.66']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--aa839907-e0e6-4949-9925-9c6e9752d37d",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 199.19.95[.]67",
      "description": "IPv4 | WISP RAT C2 nodes (active 2026-11-02 to 11-06) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '199.19.95.67']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--87578d4e-e6c2-4c6b-95ea-732fe881b263",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 199.19.95[.]68",
      "description": "IPv4 | WISP RAT C2 nodes (active 2026-11-02 to 11-06) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '199.19.95.68']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--aed7db9c-ff12-44da-9dd0-24caab754f47",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 91.92.240[.]238",
      "description": "IPv4 | Storm-3358 ARTEX servers (also check 178.15.54[.]129 from KQL typo) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '91.92.240.238']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--c4560722-ba45-4e3e-8e02-617bf40650b6",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 85.11.168[.]45",
      "description": "IPv4 | Storm-3358 ARTEX servers (also check 178.15.54[.]129 from KQL typo) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '85.11.168.45']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--cf34d6eb-dd2f-4900-8f01-2ed5221ea0dc",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 178.16.54[.]129",
      "description": "IPv4 | Storm-3358 ARTEX servers (also check 178.15.54[.]129 from KQL typo) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '178.16.54.129']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--294d50b5-a665-4b70-ba2c-34b459a416b8",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 31.77.229[.]35",
      "description": "IPv4 | Storm-3358 ARTEX servers (also check 178.15.54[.]129 from KQL typo) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '31.77.229.35']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--d23ceae5-3892-4009-b17d-c5c0bc32b1a9",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 178.15.54[.]129",
      "description": "IPv4 | 91.92.240[.]238, 85.11.168[.]45, 178.16.54[.]129, 31.77.229[.]35 | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '178.15.54.129']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--1fc39da1-ba86-4a52-a520-4b3b6f2eeee6",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 85.11.167[.]52",
      "description": "IPv4 | Storm-3358 C2 server (first seen 2026-11-04) | High | [#5]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '85.11.167.52']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--bbd79d44-3129-49b6-9283-55c49ca7ea47",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 38.244.50[.]120",
      "description": "IPv4 | Primary ARTEX jump server (exposed dir on port 18899) | High | [#3][#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '38.244.50.120']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--52762965-e1eb-4159-ad00-178ce71b3396",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.248.226[.]250",
      "description": "IPv4 | Campaign work servers hosting artex-local:perf2-20261003 | High | [#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.248.226.250']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--09d684bb-6be0-4b4e-bbc5-37c2356994c8",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.248.226[.]251",
      "description": "IPv4 | Campaign work servers hosting artex-local:perf2-20261003 | High | [#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.248.226.251']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--b6c37b51-88b8-4572-8d08-5297e1186e59",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.248.226[.]252",
      "description": "IPv4 | Campaign work servers hosting artex-local:perf2-20261003 | High | [#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.248.226.252']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--2fdf75a4-6b60-4adc-b045-7315687301e3",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.248.226[.]253",
      "description": "IPv4 | Campaign work servers hosting artex-local:perf2-20261003 | High | [#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.248.226.253']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--aa49fe25-a636-4f40-a2d9-bb5fcd030dc1",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.248.226[.]254",
      "description": "IPv4 | Campaign work servers hosting artex-local:perf2-20261003 | High | [#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.248.226.254']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--9a0fe0da-27ae-4541-b448-594e0dcff07b",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 154.201.79[.]246",
      "description": "IPv4 | Proxy pool API (:443) and upstream SOCKS proxies (:443, :11005) | High | [#3][#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '154.201.79.246']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--dbe97781-7e79-4d9a-8e08-2b3ffe5b6d44",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 205.214.59[.]31",
      "description": "IPv4 | Proxy pool API (:443) and upstream SOCKS proxies (:443, :11005) | High | [#3][#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '205.214.59.31']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--8345abf6-7603-4e43-bdd3-8579a1525aa9",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 161.8.161[.]140",
      "description": "IPv4 | Proxy pool API (:443) and upstream SOCKS proxies (:443, :11005) | High | [#3][#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '161.8.161.140']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--924dca3e-5b80-4df7-a143-502954ddd567",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 101.53.80[.]20",
      "description": "IPv4 | Additional proxy IPs tied to the South Korean financial campaign | Moderate | [#3]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '101.53.80.20']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--4ea1ed81-61eb-4b7a-b918-dcf47ad960ad",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 124.155.252[.]63",
      "description": "IPv4 | Additional proxy IPs tied to the South Korean financial campaign | Moderate | [#3]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '124.155.252.63']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--b5c19b4f-ca36-4b91-a6e5-2d459ba9370f",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.248.249[.]90",
      "description": "IPv4 | Additional proxy IPs tied to the South Korean financial campaign | Moderate | [#3]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.248.249.90']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--ba938735-172b-467d-9250-ab8920b417ab",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.158.220[.]98",
      "description": "IPv4 | Additional proxy IPs tied to the South Korean financial campaign | Moderate | [#3]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.158.220.98']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--4d30a663-c68f-4520-b52f-547bf6fa6aa1",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 103.248.148[.]84",
      "description": "IPv4 | Additional proxy IPs tied to the South Korean financial campaign | Moderate | [#3]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '103.248.148.84']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--7bb3739d-eea5-428f-96dc-c38a7621914f",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 203.160.133[.]172",
      "description": "IPv4 | Additional proxy IPs tied to the South Korean financial campaign | Moderate | [#3]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '203.160.133.172']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--2a05b178-c2c2-4442-b2c1-fc18eaa24aa2",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 209.209.85[.]38",
      "description": "IPv4 | Additional proxy IPs tied to the South Korean financial campaign | Moderate | [#3]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '209.209.85.38']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--6e01f070-97d3-413e-91e0-a5b829ddb44e",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: xcai[.]pro",
      "description": "Domain | Moderate | [#3][#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'xcai.pro']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--96fe91f7-0f0b-423a-add6-9e53f5106244",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "url: hxxps://xcai[.]pro/v1",
      "description": "Domain | xcai[.]pro | Moderate | [#3][#8]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[url:value = 'https://xcai.pro/v1']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--f33b1fcc-976a-452c-8e8c-cb1688926bda",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 31.40.205[.]155",
      "description": "IPv4 | Unit 42 API/IdP exploitation and Sub2API (:8080) hosts | High | [#10]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '31.40.205.155']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--05b53c4e-3383-4a4f-b031-4639a9755895",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 173.254.220[.]78",
      "description": "IPv4 | Unit 42 API/IdP exploitation and Sub2API (:8080) hosts | High | [#10]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '173.254.220.78']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--fffd5f20-6c59-489e-af7e-5aec2d2bcecf",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 103.100.158[.]103",
      "description": "IPv4 | Unit 42 API/IdP exploitation and Sub2API (:8080) hosts | High | [#10]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '103.100.158.103']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--3f1194db-0d7a-4962-9bed-e951c3e5268e",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 152.233.51[.]12",
      "description": "IPv4 | Unit 42 API/IdP exploitation and Sub2API (:8080) hosts | High | [#10]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '152.233.51.12']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--1d69ffee-f74e-496b-807f-65bfaeb3c541",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: lanmao666[.]com",
      "description": "Domain | Multi-tenant AI/LLM gateway infrastructure linked to Unit 42 cluster | Moderate | [#10]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lanmao666.com']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--f81be7ed-686b-4f67-8568-c989822c99f2",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: lanmao666[.]xyz",
      "description": "Domain | Multi-tenant AI/LLM gateway infrastructure linked to Unit 42 cluster | Moderate | [#10]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lanmao666.xyz']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--1e580a78-c18f-45de-84af-bfc960db657c",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 103.54.154[.]40",
      "description": "IPv4 | Datadog AWS CloudWatch mining and Cognito self-registration abuse | High | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '103.54.154.40']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--48237101-57ed-4975-b60c-1ed5d10c1c2d",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 154.64.252[.]77",
      "description": "IPv4 | Datadog AWS CloudWatch mining and Cognito self-registration abuse | High | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '154.64.252.77']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--d40ace3f-6f7b-4f38-969b-20d7ecedba1f",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 169.128.55[.]214",
      "description": "IPv4 | Datadog AWS CloudWatch mining and Cognito self-registration abuse | High | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '169.128.55.214']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--cbd03ac7-4937-4da6-be9e-1629b653c575",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 154.36.136[.]197",
      "description": "IPv4 | Datadog AWS CloudWatch mining and Cognito self-registration abuse | High | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '154.36.136.197']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--a147617b-55b6-4e8d-9327-1ccd464b29e8",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 154.36.136[.]23",
      "description": "IPv4 | Datadog AWS CloudWatch mining and Cognito self-registration abuse | High | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '154.36.136.23']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--029d906b-8c81-492e-a9de-cf6c944a77ab",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 102.216.154[.]102",
      "description": "IPv4 | Additional Datadog AWS ARTEX source IPs | Moderate | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '102.216.154.102']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--1b125124-8d4a-499f-8cda-caae87541ced",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 82.158.88[.]233",
      "description": "IPv4 | Additional Datadog AWS ARTEX source IPs | Moderate | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '82.158.88.233']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--bc10d733-431d-4894-b6db-eb7c9d9883de",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 88.229.22[.]232",
      "description": "IPv4 | Additional Datadog AWS ARTEX source IPs | Moderate | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '88.229.22.232']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--7039560c-666b-4959-8e01-df87c9aff581",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 103.54.154[.]32",
      "description": "IPv4 | Additional Datadog AWS ARTEX source IPs | Moderate | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '103.54.154.32']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--7e47c856-bdda-41a4-ab39-87b9b59fdebf",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 45.145.228[.]25",
      "description": "IPv4 | Additional Datadog AWS ARTEX source IPs | Moderate | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '45.145.228.25']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--c0b50ca3-071a-419a-a79d-363b0fd58788",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: zeofast[.]cn",
      "description": "Domain | Infrastructure domains referenced in AWS CloudWatch/Cognito attacks | Moderate | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'zeofast.cn']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--dc0c79d9-f7e6-45e0-a345-44dbb793fa91",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: yecaoyun[.]com",
      "description": "Domain | Infrastructure domains referenced in AWS CloudWatch/Cognito attacks | Moderate | [#11]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'yecaoyun.com']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--9dbc2138-2b5a-4815-b397-d91a86d8f02a",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 104.194.150[.]21",
      "description": "IPv4 | Storm-0940-linked probing of software vendors' identity systems | Moderate | [#16]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '104.194.150.21']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--721d48d1-91e6-4007-9f9f-b061c2eee377",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 167.88.172[.]97",
      "description": "IPv4 | Storm-0940-linked probing of software vendors' identity systems | Moderate | [#16]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '167.88.172.97']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--35e3e94a-76dc-48b4-9ccf-1de4ac0b7df0",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 23.106.46[.]239",
      "description": "IPv4 | Hosts artex.nhhh[.]de and llm-routing[.]com; tested stolen Bedrock keys | Moderate | [#20]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.106.46.239']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--7a38714b-639f-46ae-9d00-20c626166913",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: artex.nhhh[.]de",
      "description": "IPv4 | 23.106.46[.]239 | Moderate | [#20]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'artex.nhhh.de']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--ec9b360c-885f-4bfa-be1b-d46fb5f235ea",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: llm-routing[.]com",
      "description": "IPv4 | 23.106.46[.]239 | Moderate | [#20]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'llm-routing.com']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--7db8c413-b59e-4ae6-aae9-cc6a84fef8e4",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573",
      "description": "SHA-256 | Backdoored /app/artex ELF binary (51,210,988 bytes, server.verifyCaptcha) | High | [#12]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = 'd5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--b1735023-30e4-4641-a5fd-8f88ee45e805",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: ce85d8369ccc1a85423f1f75d2f3afaa2fab759e580da37a6891af2f7392745e",
      "description": "SHA-256 | Malicious Docker Hub multi-arch index digest | High | [#12]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = 'ce85d8369ccc1a85423f1f75d2f3afaa2fab759e580da37a6891af2f7392745e']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--22b0a07a-92f6-4f72-913b-c62e565647c6",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: cb85a7206290dc1813e3203e044741054b26c7a7c557c7d9d6d91af20aeb232b",
      "description": "SHA-256 | Malicious Docker amd64 manifest digest | High | [#12]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = 'cb85a7206290dc1813e3203e044741054b26c7a7c557c7d9d6d91af20aeb232b']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--5a6b8e0b-7b3e-4886-ac88-74eeba3428f3",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: 009e2bdd6548886a363ee06d17331c7209741273d886f1bb818bceeb416f1654",
      "description": "SHA-256 | Malicious Docker image layer containing /app/artex | High | [#12]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '009e2bdd6548886a363ee06d17331c7209741273d886f1bb818bceeb416f1654']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--d966c892-d861-4671-a024-564edd9ab6fa",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: 8b567c0244f2dbee787165aea9c4ddabaaafb0fdb3b29899ac898c60a589856b",
      "description": "SHA-256 | Reference ARTEX console favicon SHA-256 (MD5 cd3ebd16437d6d3963592f7365dd3980) | High | [#14][#15]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '8b567c0244f2dbee787165aea9c4ddabaaafb0fdb3b29899ac898c60a589856b']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--5b1796ba-e53d-4f13-8499-eddf227a23d7",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "md5: cd3ebd16437d6d3963592f7365dd3980",
      "description": "SHA-256 | 8b567c0244f2dbee787165aea9c4ddabaaafb0fdb3b29899ac898c60a589856b | High | [#14][#15]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.MD5 = 'cd3ebd16437d6d3963592f7365dd3980']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--f115fd07-bf99-4297-934b-2f47cd78a6d3",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 38.11.221[.]82",
      "description": "IPv4 | Cybrani reference ARTEX pivot (:8787/:8790) and separate ToShell/ARTEX staging host | Moderate | [#14][#15]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '38.11.221.82']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--742d1c74-000b-4e8d-b9ef-fc2ef57823fb",
      "spec_version": "2.1",
      "created": "2026-11-13T00:00:00.000Z",
      "modified": "2026-11-13T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 89.34.227[.]96",
      "description": "IPv4 | Cybrani reference ARTEX pivot (:8787/:8790) and separate ToShell/ARTEX staging host | Moderate | [#14][#15]",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '89.34.227.96']",
      "pattern_type": "stix",
      "valid_from": "2026-11-13T00:00:00.000Z"
    }
  ]
}