{"type":"bundle","id":"bundle--3b1a3c4e-0680-5097-928b-98940548c105","objects":[{"type":"identity","spec_version":"2.1","id":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","created":"2020-12-08T00:00:00.000Z","modified":"2020-12-08T00:00:00.000Z","name":"TweetFeed","description":"Community-sourced Threat Intelligence feed aggregating IOCs (URLs, domains, IPs, hashes) from infosec researchers on Twitter/X. Refreshed every 15 minutes.","identity_class":"organization","contact_information":"https://tweetfeed.live"},{"type":"indicator","spec_version":"2.1","id":"indicator--1180c7e0-9ed0-53e2-b122-262305d07433","created":"2026-05-10T00:00:00.000Z","modified":"2026-05-10T00:00:00.000Z","valid_from":"2026-05-10T00:00:00.000Z","name":"arpitgoel889.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'arpitgoel889.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053263843992748534"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46161b1a-4124-50c4-95e9-d3a5a82485b2","created":"2026-05-10T00:00:00.000Z","modified":"2026-05-10T00:00:00.000Z","valid_from":"2026-05-10T00:00:00.000Z","name":"https://arpitgoel889.github.io/Instagram/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://arpitgoel889.github.io/Instagram/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053263843992748534"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f69418e-a80a-501a-a7dd-a661351d10c1","created":"2026-05-10T00:26:00.000Z","modified":"2026-05-10T00:26:00.000Z","valid_from":"2026-05-10T00:26:00.000Z","name":"jwluck.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jwluck.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053270441473810905"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80029f73-1408-5a3e-a2b1-add62812d7d5","created":"2026-05-10T00:26:00.000Z","modified":"2026-05-10T00:26:00.000Z","valid_from":"2026-05-10T00:26:00.000Z","name":"https://jwluck.com/newsletter/click/lxnn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jwluck.com/newsletter/click/lxnn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053270441473810905"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a28e849a-0d77-5a90-9ec8-2c48429d857a","created":"2026-05-10T00:29:00.000Z","modified":"2026-05-10T00:29:00.000Z","valid_from":"2026-05-10T00:29:00.000Z","name":"dxeebol.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dxeebol.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053271216988074255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ab5dec-7811-565c-bc8f-3807a1bc5d18","created":"2026-05-10T00:29:00.000Z","modified":"2026-05-10T00:29:00.000Z","valid_from":"2026-05-10T00:29:00.000Z","name":"https://dxeebol.com/support/rvar","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dxeebol.com/support/rvar']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053271216988074255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0b5aeb4-2587-5411-8dc9-40887d51916d","created":"2026-05-10T02:00:00.000Z","modified":"2026-05-10T02:00:00.000Z","valid_from":"2026-05-10T02:00:00.000Z","name":"facebook-authentication.secure-datalink.org","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'facebook-authentication.secure-datalink.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053294013847883935"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5b54275-4c06-5ad8-8c3b-ba150449944b","created":"2026-05-10T02:00:00.000Z","modified":"2026-05-10T02:00:00.000Z","valid_from":"2026-05-10T02:00:00.000Z","name":"https://facebook-authentication.secure-datalink.org/landing/form/ee998719-7491-477e-8934-1608a3f86cba","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://facebook-authentication.secure-datalink.org/landing/form/ee998719-7491-477e-8934-1608a3f86cba']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053294013847883935"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bd0025a-f0d2-5825-9286-4323e4b10823","created":"2026-05-10T04:00:00.000Z","modified":"2026-05-10T04:00:00.000Z","valid_from":"2026-05-10T04:00:00.000Z","name":"defidappsrestore.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'defidappsrestore.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053324182784512110"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fd71377-e87d-58c2-abed-6600c8f86282","created":"2026-05-10T04:00:00.000Z","modified":"2026-05-10T04:00:00.000Z","valid_from":"2026-05-10T04:00:00.000Z","name":"https://defidappsrestore.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://defidappsrestore.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053324182784512110"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3ca518c-06d4-5289-9462-1536a3e4041c","created":"2026-05-10T04:05:00.000Z","modified":"2026-05-10T04:05:00.000Z","valid_from":"2026-05-10T04:05:00.000Z","name":"sibillacapital.com","description":"IOC reported by @RansomwareLive on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sibillacapital.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RansomwareLive/status/2053325573666087318"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a2f9559-086f-52d0-bcaf-bbdec13cc104","created":"2026-05-10T04:05:00.000Z","modified":"2026-05-10T04:05:00.000Z","valid_from":"2026-05-10T04:05:00.000Z","name":"https://sibillacapital.com/@incranso","description":"IOC reported by @RansomwareLive on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sibillacapital.com/@incranso']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RansomwareLive/status/2053325573666087318"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e869404-5cd2-5e1f-a410-2b1289dd46c9","created":"2026-05-10T05:14:00.000Z","modified":"2026-05-10T05:14:00.000Z","valid_from":"2026-05-10T05:14:00.000Z","name":"43.160.218.110","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.160.218.110']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053342785915564042"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b986275-850e-50d7-a222-93f713ea3f58","created":"2026-05-10T06:00:00.000Z","modified":"2026-05-10T06:00:00.000Z","valid_from":"2026-05-10T06:00:00.000Z","name":"amazonbylio.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'amazonbylio.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053354433459655021"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--231ca1c1-b247-5559-b69d-7b90b1f978a5","created":"2026-05-10T06:00:00.000Z","modified":"2026-05-10T06:00:00.000Z","valid_from":"2026-05-10T06:00:00.000Z","name":"https://amazonbylio.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://amazonbylio.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053354433459655021"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5685e35-22d9-5b93-97bf-b10f407e8825","created":"2026-05-10T08:00:00.000Z","modified":"2026-05-10T08:00:00.000Z","valid_from":"2026-05-10T08:00:00.000Z","name":"gmx-konto74.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmx-konto74.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053384582003642781"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97a8b137-7dbd-54a6-9670-0f62f13b0f55","created":"2026-05-10T08:00:00.000Z","modified":"2026-05-10T08:00:00.000Z","valid_from":"2026-05-10T08:00:00.000Z","name":"https://gmx-konto74.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://gmx-konto74.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053384582003642781"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a000c9de-4a89-5392-8d30-648fb1c8dc76","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"u28x.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u28x.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44b57a02-646d-559e-b1b5-926d9bddd507","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://u28x.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u28x.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8878e283-9592-54c6-83f1-67c02d0c3f5d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"z63k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'z63k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--007168d9-c1e7-5de1-a278-5769e5cccf32","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://z63k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://z63k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9be099e-2b70-5862-b6c4-c88f27dea486","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"r45x.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r45x.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc875c71-b3bc-515a-9ac7-37111eefc8a7","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://r45x.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r45x.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fbbe286-2b12-5129-9af5-f47579400799","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"a86u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'a86u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f20f068d-bb9b-5c23-ba40-85d50d49b12a","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://a86u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://a86u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deb18f3e-5a69-5fde-b580-48c52f3309f6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"g47t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g47t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b92f1e5-f6f0-5375-b07c-d4d08a322be9","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://g47t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g47t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06cf4d52-acd5-5ae5-aac1-f301d6d45a8e","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"t34d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't34d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1e5dc6e-c094-5b24-9a39-553fce2072d4","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://t34d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t34d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b14f156-37b8-5031-8c09-60235ebad290","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"k29h.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k29h.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84ca451f-8a86-5fc5-9747-f5173647fb3f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://k29h.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k29h.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0795e3ef-ac8a-5a20-a851-768ce3499068","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y28s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y28s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba0613f7-7170-5142-a8a5-3f5b337fbfc6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y28s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y28s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9e02302-ed37-50e8-9b6a-a4eb5f9665ce","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j75n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j75n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33694624-f74a-5247-aef0-544854528f53","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j75n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j75n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4ea5e80-b434-5048-9b44-417250bfa65a","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j82k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j82k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce0b0215-7b52-5a53-a6ce-0baaaf5fdcb6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j82k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j82k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92e967d3-4400-5f10-ab31-537d05968471","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j69t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j69t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba7527b3-e4c8-5794-b3d0-00e56f92b6db","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j69t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j69t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d92c4383-39ee-5b28-b869-dc3f792ea4ef","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j56y.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j56y.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d219f4d2-9364-5d40-9902-52a6f9f5b08f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j56y.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j56y.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b99a2089-aafc-5ad0-a87b-c56116e89620","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"r47b.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r47b.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3287317-0816-50c6-851c-daeed976f724","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://r47b.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r47b.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd933e21-d642-54f7-9f84-44ba1ab0f33f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"p78t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'p78t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--516a6c73-94dd-5bd4-aa17-a69b82749b50","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://p78t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://p78t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d12fb16d-bea5-5a58-9ef3-902bcb81f9c3","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j56y.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j56y.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55eedca5-76d5-5ad8-8018-52eba0a1b264","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j56y.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j56y.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a91f80cf-0a45-5845-817c-2ac9acd02f94","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"v52e.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v52e.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a972f110-f025-5a6d-b505-d1f2b6139da9","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://v52e.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v52e.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1df3e60a-3000-54ad-b8fd-66f5b4bf245a","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"n58k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n58k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d84c6ea2-7c81-5f64-ab29-2bcf1f114362","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://n58k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n58k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f981f00c-c319-5daa-b76c-d321d6be14ff","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j28t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j28t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d7d1d15-187c-5795-8f29-006d01c773d7","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j28t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j28t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94d22e37-22d2-5604-b836-5c948c1946c1","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"v22a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v22a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30fc5647-d002-544f-96f1-a099c2e1c51b","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://v22a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v22a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--820a90a2-91e4-5eea-865b-69791f622533","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y12p.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y12p.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aaad6be-2e40-528f-987d-306d06dfe4b2","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y12p.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y12p.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--024f342b-c695-54a3-9a2a-35e8a992dce0","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"v42t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v42t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15ad7ec-3e94-5798-b19b-818548564fe4","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://v42t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v42t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc55e36b-f358-5374-a503-10ef8c375b3d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y66u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y66u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd8de9b6-1e4e-5309-b7c3-744d97874f65","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y66u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y66u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbe0e4a4-0fcf-5521-9188-b117b59bb55d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"s44n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 's44n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0833a69-4447-5128-859f-4dbee1693b2b","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://s44n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://s44n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76055abe-54c1-5d47-8fa2-2398ccc1c4c0","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"u84k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u84k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1f76885-64b0-5941-ba21-18251cc058ac","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://u84k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u84k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a890e500-89d8-5ec4-b938-0bedb264631f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"g86d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g86d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12d658bd-4f12-50ef-83f0-5d34c2d13221","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://g86d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g86d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e246d41-a2ac-5aef-9a9f-a8392f5a4837","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y29v.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y29v.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51fe5ebb-e971-5848-b0f7-3f64713e365d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y29v.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y29v.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f065b5de-ee47-59f7-bd12-aa9142eee523","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"b47t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'b47t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--552c7c07-132f-513d-86ba-838b72eb4758","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://b47t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://b47t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53934beb-8fbc-5c6c-847d-6d37fdf89378","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"t45r.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't45r.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f76be1e-d34e-5549-b000-f977f2c3d3ab","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://t45r.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t45r.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27a7e541-0793-57cd-acb5-1f217aaa89a6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"g83u.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g83u.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--672aeb71-36e6-5a3a-bd96-7095da9bbb7d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://g83u.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g83u.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d6ca7a1-99db-5755-89fc-dbfc6420ba69","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"f28n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'f28n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e766c30-afb4-5431-a80b-ffb2f85e028d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://f28n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://f28n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5bd4bc5-d8ae-5403-aabf-bd14a60bf126","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://67.209.179.189","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://67.209.179.189']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcbe0ac0-b5e1-5906-9248-637acec476fe","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"67.209.179.189","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '67.209.179.189']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7951f66-0667-5231-944d-77366f0a9e62","created":"2026-05-10T08:40:00.000Z","modified":"2026-05-10T08:40:00.000Z","valid_from":"2026-05-10T08:40:00.000Z","name":"31.3.218.73","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '31.3.218.73']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053394653836427316"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dfbe2c6-b871-5bb3-b358-832db7177fdc","created":"2026-05-10T09:28:00.000Z","modified":"2026-05-10T09:28:00.000Z","valid_from":"2026-05-10T09:28:00.000Z","name":"c283d62a0b3a8b073dc436c71611f6d1ecb324b70a4f1c5cd46ec9b4beccd02e","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c283d62a0b3a8b073dc436c71611f6d1ecb324b70a4f1c5cd46ec9b4beccd02e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053406821767848397"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--945b5c33-448f-5675-bcd8-157edc2d9950","created":"2026-05-10T09:41:00.000Z","modified":"2026-05-10T09:41:00.000Z","valid_from":"2026-05-10T09:41:00.000Z","name":"mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2053410126988710029"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb6cb666-faad-5f1c-b69f-b59bc60f2c0c","created":"2026-05-10T09:41:00.000Z","modified":"2026-05-10T09:41:00.000Z","valid_from":"2026-05-10T09:41:00.000Z","name":"https://mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2053410126988710029"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b7bfb83-696e-529b-ad0b-5026fe1635d5","created":"2026-05-10T10:00:00.000Z","modified":"2026-05-10T10:00:00.000Z","valid_from":"2026-05-10T10:00:00.000Z","name":"roblox.com.ge","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'roblox.com.ge']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053414763573502092"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--829e2c12-962b-55f6-8600-9894ce5ceed1","created":"2026-05-10T10:00:00.000Z","modified":"2026-05-10T10:00:00.000Z","valid_from":"2026-05-10T10:00:00.000Z","name":"https://roblox.com.ge/communities/5040898348/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://roblox.com.ge/communities/5040898348/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053414763573502092"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3293cfd-c7e7-5f5b-884b-86c89d9b7986","created":"2026-05-10T10:36:00.000Z","modified":"2026-05-10T10:36:00.000Z","valid_from":"2026-05-10T10:36:00.000Z","name":"178.105.102.230","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '178.105.102.230']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053423935656775950"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abe4515e-8825-5853-ae9b-289e965a0c8b","created":"2026-05-10T12:00:00.000Z","modified":"2026-05-10T12:00:00.000Z","valid_from":"2026-05-10T12:00:00.000Z","name":"vasudevrameshjangid.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vasudevrameshjangid.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053444986192998828"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f60d376a-fe2e-5c50-af76-958eb9b70453","created":"2026-05-10T12:00:00.000Z","modified":"2026-05-10T12:00:00.000Z","valid_from":"2026-05-10T12:00:00.000Z","name":"https://vasudevrameshjangid.github.io/clonenetbyvasu","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://vasudevrameshjangid.github.io/clonenetbyvasu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053444986192998828"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba8d3d39-3420-54ee-9848-417e55fecfe3","created":"2026-05-10T14:00:00.000Z","modified":"2026-05-10T14:00:00.000Z","valid_from":"2026-05-10T14:00:00.000Z","name":"cloud-a34c2.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cloud-a34c2.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053475184879780230"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38ce0a24-db7e-586f-ac1f-3972dde9eca7","created":"2026-05-10T14:00:00.000Z","modified":"2026-05-10T14:00:00.000Z","valid_from":"2026-05-10T14:00:00.000Z","name":"https://cloud-a34c2.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cloud-a34c2.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053475184879780230"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd6f7d26-35ae-573a-8d5b-84c690f239c2","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"dcqxqqx.dumzv.cn","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dcqxqqx.dumzv.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--983be40b-8093-52b1-acc9-e2849a18f2bf","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"https://dcqxqqx.dumzv.cn/gpajp/accunt/lginox/","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dcqxqqx.dumzv.cn/gpajp/accunt/lginox/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1b6f075-1e86-54c2-a0c0-dc776910bea8","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"meekys.mtffx.cn","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'meekys.mtffx.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8dcff19-9c8a-5d1f-8a33-2620747f3b3a","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"https://meekys.mtffx.cn/gpajp/accunt/lginox/","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://meekys.mtffx.cn/gpajp/accunt/lginox/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9a75741-e2a3-5729-8f80-5485d105ca40","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"zamknj.xagnnx.cn","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zamknj.xagnnx.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15b42b24-f15f-56ac-a4b3-fdf01ae08d91","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"https://zamknj.xagnnx.cn/gpajp/accunt/lginox/","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://zamknj.xagnnx.cn/gpajp/accunt/lginox/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"165.154.231.146","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65ddd178-752d-52b2-bb23-35545a97df57","created":"2026-05-10T15:05:00.000Z","modified":"2026-05-10T15:05:00.000Z","valid_from":"2026-05-10T15:05:00.000Z","name":"n9.cl","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n9.cl']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053491618225979711"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20583637-0e44-5fa1-9e0c-c1842d31290c","created":"2026-05-10T15:05:00.000Z","modified":"2026-05-10T15:05:00.000Z","valid_from":"2026-05-10T15:05:00.000Z","name":"https://n9.cl/tuhgeg","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://n9.cl/tuhgeg']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053491618225979711"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffc92d68-c3de-5f44-842a-7c65102280a9","created":"2026-05-10T16:00:00.000Z","modified":"2026-05-10T16:00:00.000Z","valid_from":"2026-05-10T16:00:00.000Z","name":"portal-kucoin-login-info.typedream.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'portal-kucoin-login-info.typedream.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053505409034449333"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e44990e-69a4-54e6-8659-e003c66c0b0d","created":"2026-05-10T16:00:00.000Z","modified":"2026-05-10T16:00:00.000Z","valid_from":"2026-05-10T16:00:00.000Z","name":"https://portal-kucoin-login-info.typedream.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://portal-kucoin-login-info.typedream.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053505409034449333"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c447df66-e196-5b85-afc5-35918f54ecfe","created":"2026-05-10T16:44:00.000Z","modified":"2026-05-10T16:44:00.000Z","valid_from":"2026-05-10T16:44:00.000Z","name":"193.169.240.81","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '193.169.240.81']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053516490687778916"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f108588f-ee80-5ed1-b3cb-e543a2808261","created":"2026-05-10T16:58:00.000Z","modified":"2026-05-10T16:58:00.000Z","valid_from":"2026-05-10T16:58:00.000Z","name":"ghostupdate.duckdns.org","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ghostupdate.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053520109134573579"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e15de357-c849-53fd-95c7-dc21af4214e1","created":"2026-05-10T16:58:00.000Z","modified":"2026-05-10T16:58:00.000Z","valid_from":"2026-05-10T16:58:00.000Z","name":"http://ghostupdate.duckdns.org","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ghostupdate.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053520109134573579"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d44f449-610b-504f-ae98-78de21ad3ef9","created":"2026-05-10T17:15:00.000Z","modified":"2026-05-10T17:15:00.000Z","valid_from":"2026-05-10T17:15:00.000Z","name":"798ed7dd5b733b82b05df7fe9f6f546f","description":"IOC reported by @ReBensk on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '798ed7dd5b733b82b05df7fe9f6f546f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ReBensk/status/2053524302776132078"}],"labels":["Android","Trojan","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2f02c70-5ab4-54ad-94c5-0912cfa55513","created":"2026-05-10T17:34:00.000Z","modified":"2026-05-10T17:34:00.000Z","valid_from":"2026-05-10T17:34:00.000Z","name":"dd03408b67f24d61832ab48fc5e41f11","description":"IOC reported by @ReBensk on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'dd03408b67f24d61832ab48fc5e41f11']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ReBensk/status/2053529232308117755"}],"labels":["Android","Trojan","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac74542c-c8a4-52c0-81ca-d5493e1dcb65","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"k1dash.treeslinks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k1dash.treeslinks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb96cdf2-b035-575f-9575-ac93e5dfff20","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://k1dash.treeslinks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k1dash.treeslinks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ff6a9d-88c1-56df-b0b4-97edc7d62183","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs5send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs5send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82113f98-4111-5b69-8613-09df17007eca","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs5send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs5send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81239bb3-2918-5d8e-ac7b-7a510def6d38","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs5link.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs5link.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43f3402b-fd6e-5610-8292-dc475cd9f083","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs5link.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs5link.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68b2c657-11a0-5bc7-9473-d853ffb28abc","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs8send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs8send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--697e0a7a-d5aa-570e-a162-17ce2254c670","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs8send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs8send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--634714e2-e431-507d-ad6b-de2d03be7fd6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec3f427-969c-5bc0-b7fa-81363ac779aa","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f97c4395-8e35-53c5-8d26-383395f97989","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"kakao.com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kakao.com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ada154d4-4e92-5429-b076-60f32abc78f8","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://kakao.com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kakao.com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b37e66c-ebe1-58a8-87b0-046e104bc76c","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--648ab9d7-50be-534b-8708-38e6843214d9","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--771e33c8-080a-572c-8eaf-c1ee9603c310","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"kakao.com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kakao.com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1955d6ec-39e4-5eab-99a5-d621fc604828","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://kakao.com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kakao.com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60a40414-fd34-5677-8662-4dd1d8366ee6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"aldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b829a3e7-0858-5c94-9c84-78dafbfdfe9d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://aldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://aldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e73ddf2-9d55-59fd-8cc2-b1d8f54e6170","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs-asend.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs-asend.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2eb59ae-11f8-5e4b-93c1-4351a4bf2d67","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs-asend.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs-asend.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccf0fb85-c16e-5f07-bc97-c7753b0612f4","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"atdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'atdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d671352-f6e4-5f18-8278-e047496b2c3c","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://atdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://atdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3de41863-b12a-5de1-a681-57a67982742b","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"akdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'akdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46789540-e67b-5f4e-b2c5-fe5964f8a0cf","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://akdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://akdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65346ca0-62a4-5098-b5ae-5335f2f6d413","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"amdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'amdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63f60dd2-f2cb-5d30-8758-7e9b703c2bd3","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://amdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://amdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9aee9a8-4729-56ac-bebf-afa895170138","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"aodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ecd247a-967e-594e-9507-e35013d912ac","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://aodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://aodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--810949ca-be59-5547-af36-acd870178e44","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ledocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ledocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d87fddf6-2b61-54bf-9d86-43c9118e338a","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ledocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ledocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24999251-fb97-5a90-9613-c50d7c57d8ae","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b496403-8005-5677-bb78-80e0134756fb","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0676b36e-aa24-51d1-b00d-2a5e4046a464","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lidocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lidocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c767a8cd-a757-5beb-8c61-91eed197e2b9","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lidocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lidocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c2568ed-cb8c-59aa-b4aa-fd7f84adb83a","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31ad925b-7914-5d65-912d-50328b053c63","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8223145c-b072-574a-a935-60c901f91f25","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2064cadc-f913-51e3-8651-a52645f1e4d4","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3122ec76-98b0-5b00-ab9e-324b108218c7","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc58a33c-d535-5c1c-9dc3-9e6b46b2e5e5","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed5f7fa9-0598-56d2-994b-989a07e8b8ac","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25d0b53a-97fe-54e6-9f78-357ffc2a167d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca11f41b-0ae4-5ec6-a003-11ce8382dd64","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bfb91b1-3d72-50bc-be23-7f14ebaa239c","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f5816b5-ec89-5527-b910-f2aac81b4cd6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ntdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04ebdf31-a282-5627-a349-c02822d55e77","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ntdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e5da4d0-2597-5e91-954b-20fa0645efea","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nidocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75c00ce8-052a-5b49-9fcc-6bf2e5ed3b5d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nidocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fa0b423-3eea-56c1-882c-ca62b77d51ba","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbd7dab1-1854-5cb2-b656-4bdb5116ab77","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--992ed6e8-e42a-5bd7-a82e-9a605bfe1168","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"an.nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'an.nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77a15621-906c-5cb4-a931-08b8fcab7b08","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://an.nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://an.nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19ae2d01-561e-5a9b-aa74-98fb781313d7","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5af23202-41f1-58f9-8587-0564b535c789","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c61ada2-7470-5391-874f-4fa81d0dfd5d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0976ba05-24a0-53d4-9399-bd48a1d727cf","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10465233-5f31-592b-b2f7-b5ded746badc","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f631854d-f0dd-5fc6-8bd3-0e885df6cb79","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c958ece8-42cd-5b0e-a2eb-487a746ddc35","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"mpdocument-home.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mpdocument-home.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8821557a-eb2a-5f53-aa1b-db1d34c28ad6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://mpdocument-home.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mpdocument-home.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56c43b7e-7ae4-5e43-8aa3-893b4e7c664b","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"medocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'medocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4e688b4-d62a-5725-a46a-09e525092fa9","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://medocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://medocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6c3e145-fff0-527d-9978-02d73204e355","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"mtdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mtdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f65793d-3cfb-532d-b662-23982f7fceac","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://mtdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mtdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c53eb897-02a4-598d-b8bd-01fd5eda6e4d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"midocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'midocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f93a1f6-4d94-590d-91b8-5c7aa88fdf7f","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://midocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://midocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0430479b-daa1-5c20-b9ac-29aca5ed0801","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"mkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2774a9b2-ad88-598b-b7ee-5547c3c1db3d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://mkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0dc332b-8fe5-58a2-9efb-c2d3ff9de2f3","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0001221b-c96d-58c5-9f3f-858211e1e81a","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e8f01a3-8459-5794-b4ff-1fd7e4287d88","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"dn.modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dn.modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b1c2be4-ecf9-58dc-9428-4e6a2263212e","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://dn.modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dn.modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--004a1c72-3ec0-5a25-ada9-f0363ecbe69d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://27.102.138.146","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.138.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e61b34b-092e-551e-8efb-423ac19f6ed7","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"27.102.138.146","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.138.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a46a0d9-d726-5291-aa36-ad8fe4fa70ee","created":"2026-05-10T17:49:00.000Z","modified":"2026-05-10T17:49:00.000Z","valid_from":"2026-05-10T17:49:00.000Z","name":"docusign-signing-evelope65792.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docusign-signing-evelope65792.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053532840361402397"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1693d352-1c00-50d4-9199-7cef8e5b70f3","created":"2026-05-10T17:49:00.000Z","modified":"2026-05-10T17:49:00.000Z","valid_from":"2026-05-10T17:49:00.000Z","name":"http://docusign-signing-evelope65792.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docusign-signing-evelope65792.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053532840361402397"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0741263-eed8-57f0-b60c-0211778d9722","created":"2026-05-10T17:51:00.000Z","modified":"2026-05-10T17:51:00.000Z","valid_from":"2026-05-10T17:51:00.000Z","name":"goattechnologies.co","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'goattechnologies.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053533407791997401"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33f3b0f6-f0d5-5459-9b47-a2b7a17f74dc","created":"2026-05-10T17:51:00.000Z","modified":"2026-05-10T17:51:00.000Z","valid_from":"2026-05-10T17:51:00.000Z","name":"http://goattechnologies.co/wp-admin/js/DDDDD55666244hh4y4888111rfdr74gggghdd22122111usignnewcoded231view231%20(2).html","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://goattechnologies.co/wp-admin/js/DDDDD55666244hh4y4888111rfdr74gggghdd22122111usignnewcoded231view231%20(2).html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053533407791997401"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f8ed862-a020-5129-a9b7-99339a121f5a","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"apptechnology.xyz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'apptechnology.xyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b5af872-a0d6-5f20-9299-dc9401c40677","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"http://apptechnology.xyz/bluene-upload/approved-028484-downloads.html","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://apptechnology.xyz/bluene-upload/approved-028484-downloads.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad468974-f2a1-55db-a311-52826d5407b3","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"accobymlrands.vu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'accobymlrands.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--459c2db8-4bc6-5410-ae09-d82f0138f9b1","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"http://accobymlrands.vu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://accobymlrands.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f67daf0a-9e30-5a0e-9f87-706d870c3e41","created":"2026-05-10T18:16:00.000Z","modified":"2026-05-10T18:16:00.000Z","valid_from":"2026-05-10T18:16:00.000Z","name":"volorecoverydocuments.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'volorecoverydocuments.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053539599935263161"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca0604d9-e176-56d6-b12d-837c8b69bdfe","created":"2026-05-10T18:16:00.000Z","modified":"2026-05-10T18:16:00.000Z","valid_from":"2026-05-10T18:16:00.000Z","name":"http://volorecoverydocuments.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://volorecoverydocuments.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053539599935263161"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0123834d-288f-5556-9e75-baddf0dd2526","created":"2026-05-10T18:16:00.000Z","modified":"2026-05-10T18:16:00.000Z","valid_from":"2026-05-10T18:16:00.000Z","name":"961528b48b761f9f207978bc7ebac024","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '961528b48b761f9f207978bc7ebac024']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053539599935263161"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41d3c5e3-4b17-5489-984c-b6825903f5eb","created":"2026-05-10T18:50:00.000Z","modified":"2026-05-10T18:50:00.000Z","valid_from":"2026-05-10T18:50:00.000Z","name":"7bebc4b248402dbf988b92eb7d9c86797bb302b983e63ce0d2dba96f0f8a345a","description":"IOC reported by @BlinkzSec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7bebc4b248402dbf988b92eb7d9c86797bb302b983e63ce0d2dba96f0f8a345a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/BlinkzSec/status/2053548124132581622"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1a91431-9256-5a27-b75b-38db5357551b","created":"2026-05-10T18:50:00.000Z","modified":"2026-05-10T18:50:00.000Z","valid_from":"2026-05-10T18:50:00.000Z","name":"c38c79fe170c54976c634f50e2a7ca090719366eabad58ec2011c18775c3366d","description":"IOC reported by @BlinkzSec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c38c79fe170c54976c634f50e2a7ca090719366eabad58ec2011c18775c3366d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/BlinkzSec/status/2053548124132581622"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b12989b3-ea97-5124-93a9-f6c8dc4ba09e","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"medellin2026.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'medellin2026.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b54c4d4-9aef-527e-9570-eb75ec139535","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"http://medellin2026.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://medellin2026.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5060d10-49e1-5541-8086-cb0b0ebfb710","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"http://46.246.82.6","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://46.246.82.6']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1faffe32-81d5-544c-9fdd-60fe212f2ec3","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"46.246.82.6","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '46.246.82.6']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49cc0425-ef18-52e2-b95a-b8be3f69f85b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9576de29-bc4c-5549-b3e6-66bbb3e6771a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4e72b08-a140-57f9-a1bb-29a9a1b00475","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--038bab13-eac0-5ff0-ae09-2f9c3c4d2879","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc07affc-d597-51de-aef7-415b7a2ca76c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--857ea4e2-24c0-58ba-b944-954e5fd6d823","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fdb0b77-155d-5134-94ca-f2cea89e922c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90110475-e7ae-5f3a-b8e4-73e6034bf3fd","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--423b0a5f-39e1-5ff9-ae13-f99c6cfc07d2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fa91843-dbe4-5feb-9416-453c5feeb097","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4a79fd8-2811-5c33-a8b1-6c053afccb88","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adc49191-a397-5c3f-badc-11b907ad0334","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5324a746-f405-58df-b11d-75fdc777826d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53186467-b84a-55e5-81bd-bcb8666954ad","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae303986-2dee-5002-a055-713ae46d0e45","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cc8afd1-d530-55b8-91c3-711ef4b22984","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7b40b10-2147-5a6c-9a55-4600a4235c1a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"qeing.qooglegle.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qeing.qooglegle.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--812ec12c-38b9-5356-8fd5-e2fcd524e7db","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://qeing.qooglegle.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qeing.qooglegle.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c86c3943-98c1-514d-b07d-f727480e9512","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"mail.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--198580bb-00b7-5fd8-8174-2e7597fecea7","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://mail.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mail.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d03675d7-cb85-5400-abbd-bab1c2251b06","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f799fed0-370d-5fac-98a9-a73eefe31786","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a44ad71d-cda0-5176-b84e-50a3933c0874","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrcorps.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrcorps.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aab1018-4900-50fb-9e31-b00447ed237f","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrcorps.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrcorps.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acb70d05-c83d-5e59-80f7-54f508b30120","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b926697-5656-55e7-98a8-f7bc4edf6148","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b79f499-13c5-5947-a6b4-9741b6970188","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.severalrule.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.severalrule.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e87472f0-0861-5db1-8c9d-c3e4b123e25e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.severalrule.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.severalrule.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f32a1d87-e7ab-5957-acaa-fdeb79fa8371","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.combookmark.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.combookmark.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dceeeccf-3386-5532-961c-ddced021e1e5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.combookmark.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.combookmark.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d3262d7-b3e1-5564-b734-669ee61215ab","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"global.homeandroid.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global.homeandroid.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5e8cd38-0757-5183-844f-78571fc08bef","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://global.homeandroid.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global.homeandroid.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f88b4e8-5f68-5c63-8499-0ca8fb25b62a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"view.checkoptionview.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'view.checkoptionview.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--911a73ed-597b-590a-95b1-5966ec03a87d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://view.checkoptionview.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://view.checkoptionview.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0383bff4-5cc9-5c06-b582-e0da0d6ee2ec","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"size.accountverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'size.accountverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8769152f-f74c-5d2a-8e93-76993ca5d50b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://size.accountverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://size.accountverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1eea58c-a35b-57dd-980f-472e2c25e381","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"retry.globalpayment.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'retry.globalpayment.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d3d4c3-df0d-50d4-b494-aef814efd654","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://retry.globalpayment.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://retry.globalpayment.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b7ecaff-f604-56cc-975a-3e3d5357809a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.onelinesvcads.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.onelinesvcads.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23c8a751-5e57-5a41-b230-19a921e8e347","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.onelinesvcads.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.onelinesvcads.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--476c6cf3-82e9-509e-9423-723607ead180","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.usermadver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.usermadver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eebd035a-e42f-50fe-9347-17b8965c3b3b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.usermadver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.usermadver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--994120a4-08fd-561a-a428-286023f9eb71","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.paymentglobalserver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.paymentglobalserver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8a45838-f81e-5338-b314-74014255bbe7","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.paymentglobalserver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.paymentglobalserver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b28c69a4-054a-5863-9867-37777ca72695","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"service.deliverymailsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'service.deliverymailsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--364a55a8-2e4b-545d-8eca-0f589673dddb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://service.deliverymailsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://service.deliverymailsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4522ceb7-a45a-5ea7-808c-6bbe77f66bef","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"security.accountuquery.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'security.accountuquery.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f764a2a6-dd8b-5459-b25a-d0e44f631564","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://security.accountuquery.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://security.accountuquery.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04e1f677-b281-5975-84d4-03950b59a83e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.usernormalsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.usernormalsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eae41b4-085a-5915-a88a-c81a302cecc4","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.usernormalsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.usernormalsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--533842d3-5668-5a06-a2fb-d6b3ba9deb98","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"service.linkyoursecurity.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'service.linkyoursecurity.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cca79b3-7242-5232-a3d9-9c0c6ced4252","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://service.linkyoursecurity.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://service.linkyoursecurity.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d3f7593-ecc8-54d6-921d-ef11630d7667","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"loein.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'loein.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f3c2608-a74a-5340-aa44-13e722313393","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://loein.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://loein.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f00d1c4-2662-553f-bbb9-7beb744b818e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"n.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17ea99a2-cf84-5ef7-9d16-44e6f81f9484","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://n.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--846b6f70-fb38-55eb-a285-a7d94b24e3d4","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"fy.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fy.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99d520e8-20bd-5a69-8b42-a1097f19edf5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://fy.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fy.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd7cfd3e-ab2f-577c-bbbe-1c1fee75d51a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"jser.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jser.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89bf67e5-4a41-51a1-ac70-88ec6b798c17","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://jser.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jser.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--050e1baa-308b-5e40-8181-2c0e5c981a32","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.changepaymentoption.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.changepaymentoption.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d88a529c-93c8-5c29-85e4-6d0ec0dfef8f","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.changepaymentoption.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.changepaymentoption.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--630e1742-cd6d-5df8-8cf3-140eac905089","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"45billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '45billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--339dfdca-d955-576c-aedd-7f7712529352","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://45billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc66e202-c81e-56c4-b664-6b26d57e31ef","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"45nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '45nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d2695aa-f68c-5bf4-a380-562727d61a75","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://45nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d66c8f5-f1c4-5f9c-a9bc-be71456e3afe","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"45chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '45chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6a041ff-f084-5629-851b-1fe81538bb69","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://45chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba91a144-d233-5b8c-acbb-bfa0c2d39c34","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"policy.usermemberauth.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'policy.usermemberauth.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c855e23b-7c11-5b36-a8fe-589fb8397103","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://policy.usermemberauth.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://policy.usermemberauth.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb155a2c-dba3-5c74-bd19-14e836eed7bd","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d3707d1-f7cd-5fc9-88ea-33a38555d9d9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7dede71-97c1-5bd7-89bf-1f5d087e94d0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"service.useraccountpolicy.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'service.useraccountpolicy.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5e7870d-910c-5dd8-80e7-8e9d2fdaf6ab","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://service.useraccountpolicy.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://service.useraccountpolicy.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91f80e33-8cbf-5232-b728-6c5a08677d78","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"user.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'user.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93c3d937-f15f-5054-ae8e-4a4cfd026bb6","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://user.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://user.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad269d20-9ec4-530a-959b-d77076549643","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--902491a8-2657-5a4f-b996-f025e15f2b21","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3748733d-2931-5b12-8343-bcbae2e8c42e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db924131-026d-5786-9418-b4c7dba33757","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca6b6901-e92a-5fe2-a2e1-e04fbd01d869","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f27f299a-3c06-5f9d-9d7f-1ee3d0ceb092","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce84c309-642b-55d5-9218-02c6d979fbca","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25a44351-d8d0-5f03-840a-90663ea7ff90","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28c87bd1-3807-523e-b8f6-4581b83fe937","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4303fee8-1117-53f7-9fd5-9856f4c46c19","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c3fa482-2f21-59b7-b14d-ccd95e22de52","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--585e864a-eb37-59b6-b8a8-b5f21f8363c9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92aa80dd-4792-5381-a41d-ca2b943bdf2b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e08e5a80-d2cc-529e-8141-cd17be21f66d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d7ab530-b965-5ae1-87f9-d8c1aeb86474","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--410f97cd-a686-500a-8a7c-7cb6c5c011ee","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9ca37f5-0a24-5372-a5a7-eab62e3057f3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be9b6a63-4a8d-5ef7-b6a3-5374ba883631","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c7847dc-4e19-500f-91b6-dfc75b4f2235","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--679604c3-f3a3-5cb7-b2a5-43765adb352c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eed81ad-8d1a-5a8c-88f8-830cea6e2a78","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3917638f-2df5-5859-a9c8-3f3d9e7d9ea9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1b8449e-2177-52b4-9399-9e6aaae67252","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f67a42e6-46ae-5152-8142-7fd33987c93c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--646770a2-3547-5535-a249-ff5b24665dd9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a270b7b4-169b-535a-ae9f-86173540ea9d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e508e0f-4979-52f5-b997-d2079d0d0b9d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d984a1d7-658c-5b76-9390-e94d0da41dd2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7082be0-1db1-501a-9d14-fdcc6e6b8fa8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"chk.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chk.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f6e5d2b-f36f-5b61-9427-dd7061d72b58","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://chk.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chk.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e446368d-53c5-54ee-b27c-afbc73cc6c79","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85475bd6-fb59-5609-8176-ca9fd6d602d2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68ed52e3-2d40-54b2-a338-a8fb1838c5d8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ca9a935-acf5-52cd-adf7-cb0b9c1b366b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e057209-3a93-5946-9137-2e8687be55d1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"edoc.ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24ddcfe1-88fd-54da-aebe-b49f3f3d7dcb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://edoc.ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8110779f-e550-51da-9b04-a5fd0e6acab4","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"one.billmatedoc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'one.billmatedoc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25bd483a-e72e-53d2-b459-5350108b033c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://one.billmatedoc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://one.billmatedoc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--368adf70-7608-5425-b490-0e6a652afbf0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f489f2f-e5ec-58c2-896e-2466a00fe6cc","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97cf51f4-1fae-5c6b-a7a4-71a7fbe748b2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"randstring.npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'randstring.npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec8d664e-1664-5934-9393-c901c5be84da","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://randstring.npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://randstring.npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e298972-cdbf-56f1-9008-586ca9eb0b92","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"docinfo.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad0b313e-adb8-54ba-930b-9f5f6ed7b998","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://docinfo.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2053a6b-3ecc-587c-9a92-fac5819b6cca","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b136e83-aba9-56b5-b14d-15ce4e471681","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59a22fef-ebf5-5f66-9a00-50677dca7dc5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--529a4113-d91d-520e-aad9-da4d45b83231","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86f1d16b-5366-5396-8361-54073eb19c56","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c4c74fd-4d79-589a-92e4-3e8e9da6d795","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47c12e98-6f60-5c55-a50e-801dcde2cda0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"chk.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chk.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f736b80-69a7-5520-8066-55b8dabb4ad5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://chk.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chk.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58888866-45f2-5f8d-9b26-6bd51a1a6658","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2290738-0886-5e48-867f-3d8098490004","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27153e41-fcfc-5f94-abbc-e7b5bd6422a8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usr.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7506c2c-7c9c-570e-9222-b64e4d6d3c4b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usr.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b81b78f-27ee-5676-9814-7e76079489e9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64518fc7-99fd-574a-8bb8-b3210c95b712","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--815929a4-5192-5970-b40c-55be67c6a066","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--598262cb-d12c-59a3-b8b0-0e60bde89474","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5be5a50d-eaf2-57f7-b333-15cf0cb22cdb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61059bc0-8425-5698-afb6-ed1276ab8716","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c847c52f-c167-53a7-ad6b-4f9870c9a277","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--149cc488-27c1-5b60-ad39-878ed859e9dd","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff7c7996-09ed-58d2-ac39-2cf67beaf690","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"edoc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efc1c422-8677-55a8-be82-8fa8a3836ae0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://edoc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b692c60-09b7-5825-bfb0-7bb4eaf12605","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrsessioncheck.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrsessioncheck.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5c33abc-7984-5b8c-916f-bc01db173a15","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrsessioncheck.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrsessioncheck.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c81a95c2-c524-53d5-b998-75883cb1f878","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e1c5d0b-8ba0-57b3-a698-e4d2b3f8c987","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc6d9ddc-386b-57da-b027-6326eee1de27","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"access.usercorpsetting.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'access.usercorpsetting.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cd40e5e-8942-5ee0-8c31-3a9a61bde3a3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://access.usercorpsetting.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://access.usercorpsetting.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--474356cc-0137-5655-9b40-600a83bea92c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b8b848c-2f9f-5e16-b160-4d382831a659","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffdaa372-df76-591c-8e0a-42a00b9dc80b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a424427e-d932-5870-b7c8-1cdf0c6efcb8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8241135-41aa-5daf-bac3-203be48f5b37","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.okxdeliverasset.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.okxdeliverasset.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--324e2bb7-17f1-5a0c-a64e-b1facb1c75e8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.okxdeliverasset.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.okxdeliverasset.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--299cd4e0-0e23-5365-91e5-a3e63a285e72","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2351cb7-5ca3-52fd-8cda-5f042bba2086","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cef7846f-3707-5db5-86be-dfe3fc2937cb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e937b7db-5178-5fc0-ac8a-2de9e65f4f1c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6b30fa1-bd1e-5e32-bfc8-840536096391","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95393c09-c734-5c91-bf02-e1a1d1877b59","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e6fe056-ebc1-5092-a4d9-d0532e793671","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd936531-9eb7-5d52-9e72-70e297ce81b2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2027d37-c589-5600-b7d3-4cee11ab8b89","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aac38cdc-efff-5b45-98d7-ef736dd865a2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0f9cd43-8e97-5c15-aae4-49183235fef3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"userinfo.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'userinfo.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee842a31-9afa-5aac-b2a8-1425d870d8f1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://userinfo.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://userinfo.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3711b93b-7630-524c-9c97-4ec7de5046b3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dda283d9-285a-532e-8e19-b4e1a1432c6f","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf6b32fc-1425-516a-8edf-1f95e0d9ad3d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fc15d46-d9ef-5f0f-afff-8070043be4f1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fe30588-608f-5634-b964-8009c0cffdf7","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fa49edc-9bd6-5dbe-b507-94705c68b27d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66016ec0-f448-59c2-91b4-ef679a6e5797","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--361c21ac-9aa7-5df1-b4f9-2da2f17a2409","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--153c06ad-4287-5c68-a071-05afe415527e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1eb98123-2bcd-52a0-89fc-9683d128dc7c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--468cf673-eb61-5a2c-89b8-cdeb14502589","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"repterminvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'repterminvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2f56252-056f-5f3b-bf7a-e49ef832e1a6","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://repterminvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://repterminvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b57265e-d9a5-5587-9045-1224d89f518e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.siteuserverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.siteuserverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71d94339-ff34-529b-8687-c17c4605a305","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.siteuserverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.siteuserverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b33112a-f55d-5a38-9f83-41d3ed1d031b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"access.userrecoveropt.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'access.userrecoveropt.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73d737b3-ce27-5751-8048-bde19a514df8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://access.userrecoveropt.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://access.userrecoveropt.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63dc74d8-5334-5c6e-87e5-2fc5005ec71d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.accountuserservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.accountuserservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3a649ee-4e59-5d1b-a3e0-a4d5ca11623d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.accountuserservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.accountuserservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ae589bb-5a3a-51fb-be9c-788e815b5442","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.accountverifications.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.accountverifications.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32b14ce9-7349-563b-a4f2-4c3c5847a880","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.accountverifications.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.accountverifications.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34a29d79-bf8f-5e1d-8f42-2d5638540830","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"access.userreverify.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'access.userreverify.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fd8fc40-5358-54db-afae-07dbba32e4af","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://access.userreverify.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://access.userreverify.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c5e7451-4a36-51ab-b04e-e144e004d4b1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd4e3280-7e5e-5546-b4fe-04d3bd169362","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1131e8fb-be3e-506c-b39d-0db6a98e2424","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0644f04-26f8-5361-8af1-9452bbfa9fbe","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d169baf3-c0ec-53c6-938a-77306073e49d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://27.102.138.45","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.138.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1208755a-74cd-5d28-a2f5-afe51730ce2e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"27.102.138.45","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.138.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44435bb8-ea43-52f3-bc72-1d53264d3a9a","created":"2026-05-10T22:00:00.000Z","modified":"2026-05-10T22:00:00.000Z","valid_from":"2026-05-10T22:00:00.000Z","name":"taha1344.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'taha1344.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053595978125496548"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ea99f88-b7c1-520d-89cb-bffa7fc9091f","created":"2026-05-10T22:00:00.000Z","modified":"2026-05-10T22:00:00.000Z","valid_from":"2026-05-10T22:00:00.000Z","name":"http://taha1344.github.io/Spotify","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://taha1344.github.io/Spotify']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053595978125496548"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d47decba-f159-5428-8915-6a600dd46f78","created":"2026-05-11T00:00:00.000Z","modified":"2026-05-11T00:00:00.000Z","valid_from":"2026-05-11T00:00:00.000Z","name":"re11133.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 're11133.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053626250023837980"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27350de3-6519-5901-80e5-d1c1e7a613c9","created":"2026-05-11T00:00:00.000Z","modified":"2026-05-11T00:00:00.000Z","valid_from":"2026-05-11T00:00:00.000Z","name":"https://re11133.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://re11133.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053626250023837980"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1fa25f9-8343-5b9e-90ed-c668731f851f","created":"2026-05-11T00:17:00.000Z","modified":"2026-05-11T00:17:00.000Z","valid_from":"2026-05-11T00:17:00.000Z","name":"cqizvybx.bhmsbp.cn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cqizvybx.bhmsbp.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053630487198126535"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfc6e74f-2b2e-52f0-881f-b1768e3cb28e","created":"2026-05-11T00:17:00.000Z","modified":"2026-05-11T00:17:00.000Z","valid_from":"2026-05-11T00:17:00.000Z","name":"https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053630487198126535"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21b7a6e1-82f8-54ad-942d-39d8f642f675","created":"2026-05-11T02:00:00.000Z","modified":"2026-05-11T02:00:00.000Z","valid_from":"2026-05-11T02:00:00.000Z","name":"135461223.site","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '135461223.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053656394256019686"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae9ac8f8-d9ed-5f72-b362-97fad46fd1df","created":"2026-05-11T02:00:00.000Z","modified":"2026-05-11T02:00:00.000Z","valid_from":"2026-05-11T02:00:00.000Z","name":"http://135461223.site/948/e64b5443-dfd0-47b7-9768-e62bcd731958/730140","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://135461223.site/948/e64b5443-dfd0-47b7-9768-e62bcd731958/730140']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053656394256019686"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8152397-8f6f-5bf5-8eb0-fb0169a2fd1a","created":"2026-05-11T02:50:00.000Z","modified":"2026-05-11T02:50:00.000Z","valid_from":"2026-05-11T02:50:00.000Z","name":"http://130.78.217.194:8888/bot.sh","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://130.78.217.194:8888/bot.sh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2053669002140938351"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c10d0fda-06de-5483-ae97-e0d49957cc87","created":"2026-05-11T02:50:00.000Z","modified":"2026-05-11T02:50:00.000Z","valid_from":"2026-05-11T02:50:00.000Z","name":"130.78.217.194","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '130.78.217.194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2053669002140938351"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c63619d-c263-55f5-a790-f451d480a92b","created":"2026-05-11T02:50:00.000Z","modified":"2026-05-11T02:50:00.000Z","valid_from":"2026-05-11T02:50:00.000Z","name":"06f55a73b369040bee42de084027d3dc","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '06f55a73b369040bee42de084027d3dc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2053669002140938351"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--323eca74-77f1-5bbc-95b7-dcd16a3a29f0","created":"2026-05-11T04:00:00.000Z","modified":"2026-05-11T04:00:00.000Z","valid_from":"2026-05-11T04:00:00.000Z","name":"eth-login.webflow.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eth-login.webflow.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053686613176181096"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f5b541d-706c-5bb4-8e21-70106991a8e7","created":"2026-05-11T04:00:00.000Z","modified":"2026-05-11T04:00:00.000Z","valid_from":"2026-05-11T04:00:00.000Z","name":"https://eth-login.webflow.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://eth-login.webflow.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053686613176181096"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06966599-9c7f-55fb-953d-b5777dbc782e","created":"2026-05-11T04:40:00.000Z","modified":"2026-05-11T04:40:00.000Z","valid_from":"2026-05-11T04:40:00.000Z","name":"85.239.155.68","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '85.239.155.68']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2053696616104857659"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--95800f76-9b44-56ec-a150-a2c1d0c947ac","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"70.34.243.236","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '70.34.243.236']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2053707334271279498"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e748b041-a8a0-5572-bd02-041ff894e1d8","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"ransomware-c2.com","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ransomware-c2.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3459e6fe-a078-5cf9-8ea0-a3b5fc8bf6b3","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"http://ransomware-c2.com","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ransomware-c2.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--634eee86-0ad3-500d-893c-7d69e8e2efdc","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"ransomwarein.bio","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ransomwarein.bio']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--26280804-4640-5ca0-95be-affe36b681d7","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"http://ransomwarein.bio","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ransomwarein.bio']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--164d0224-eb94-51d0-86c3-e928479f2084","created":"2026-05-11T06:00:00.000Z","modified":"2026-05-11T06:00:00.000Z","valid_from":"2026-05-11T06:00:00.000Z","name":"ayushsingh728.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ayushsingh728.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053716785858216045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7681dcf0-df9c-5028-8f83-71cab7b079e8","created":"2026-05-11T06:00:00.000Z","modified":"2026-05-11T06:00:00.000Z","valid_from":"2026-05-11T06:00:00.000Z","name":"http://ayushsingh728.github.io/Netflix-Clone","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ayushsingh728.github.io/Netflix-Clone']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053716785858216045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8655cd31-11af-5459-ab54-10c96464f4e7","created":"2026-05-11T06:25:00.000Z","modified":"2026-05-11T06:25:00.000Z","valid_from":"2026-05-11T06:25:00.000Z","name":"104.168.81.172","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.168.81.172']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053723171787035043"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--220dda2e-e30c-51ac-a796-3440bde76c78","created":"2026-05-11T06:25:00.000Z","modified":"2026-05-11T06:25:00.000Z","valid_from":"2026-05-11T06:25:00.000Z","name":"107.172.132.231","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '107.172.132.231']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053723171787035043"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c751534d-7e53-5ee1-b227-adac0aaba0a0","created":"2026-05-11T06:51:00.000Z","modified":"2026-05-11T06:51:00.000Z","valid_from":"2026-05-11T06:51:00.000Z","name":"totallyaboutweather.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'totallyaboutweather.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053729800372785348"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a6b3b91-5246-5b1f-bc37-5039c048c5c4","created":"2026-05-11T06:51:00.000Z","modified":"2026-05-11T06:51:00.000Z","valid_from":"2026-05-11T06:51:00.000Z","name":"https://totallyaboutweather.com/BpYeOhCAySak","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://totallyaboutweather.com/BpYeOhCAySak']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053729800372785348"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9d0297f-d447-52a7-a9ba-6b126a6f2c0c","created":"2026-05-11T07:28:00.000Z","modified":"2026-05-11T07:28:00.000Z","valid_from":"2026-05-11T07:28:00.000Z","name":"104.200.67.47","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.200.67.47']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053738879728099652"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59e52375-41a6-5995-b452-d10117e6cbf1","created":"2026-05-11T08:00:00.000Z","modified":"2026-05-11T08:00:00.000Z","valid_from":"2026-05-11T08:00:00.000Z","name":"amazonclone-steel-two.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'amazonclone-steel-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053747001083257213"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddd75d75-e458-51e0-9516-b1d500e19bb5","created":"2026-05-11T08:00:00.000Z","modified":"2026-05-11T08:00:00.000Z","valid_from":"2026-05-11T08:00:00.000Z","name":"https://amazonclone-steel-two.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://amazonclone-steel-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053747001083257213"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a50718e-9ed0-5a1c-b84f-abc629ea1f1d","created":"2026-05-11T08:31:00.000Z","modified":"2026-05-11T08:31:00.000Z","valid_from":"2026-05-11T08:31:00.000Z","name":"99.83.192.149","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '99.83.192.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053754734268252309"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7488435-c1eb-5566-aa21-da11e31cfef4","created":"2026-05-11T08:31:00.000Z","modified":"2026-05-11T08:31:00.000Z","valid_from":"2026-05-11T08:31:00.000Z","name":"13.248.236.92","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '13.248.236.92']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053754734268252309"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b76978b-e050-57de-a988-eaf53a74d007","created":"2026-05-11T08:31:00.000Z","modified":"2026-05-11T08:31:00.000Z","valid_from":"2026-05-11T08:31:00.000Z","name":"3eb7ddfb99097f35279e3a44fff44ff27d19389da9ba99d65ccde9716f21b91c","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '3eb7ddfb99097f35279e3a44fff44ff27d19389da9ba99d65ccde9716f21b91c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053754734268252309"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7681d30-0d2e-5236-851d-59f334c0ab72","created":"2026-05-11T09:21:00.000Z","modified":"2026-05-11T09:21:00.000Z","valid_from":"2026-05-11T09:21:00.000Z","name":"cloudcraftshub.com","description":"IOC reported by @nextronresearch on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cloudcraftshub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/nextronresearch/status/2053767476651995310"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--192ff736-0d8e-587a-ac94-f1cd149d3cad","created":"2026-05-11T09:21:00.000Z","modified":"2026-05-11T09:21:00.000Z","valid_from":"2026-05-11T09:21:00.000Z","name":"https://cloudcraftshub.com/api","description":"IOC reported by @nextronresearch on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cloudcraftshub.com/api']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/nextronresearch/status/2053767476651995310"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e12a0bd-4f4f-5440-ac6d-9cf16221ea05","created":"2026-05-11T09:21:00.000Z","modified":"2026-05-11T09:21:00.000Z","valid_from":"2026-05-11T09:21:00.000Z","name":"f90e131ec641d1cda33800217bdf6295a0c95d8f4b2ef0406ecda78ce19685ad","description":"IOC reported by @nextronresearch on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'f90e131ec641d1cda33800217bdf6295a0c95d8f4b2ef0406ecda78ce19685ad']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/nextronresearch/status/2053767476651995310"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--67c97077-45f8-5b2c-a368-8477078218dc","created":"2026-05-11T10:00:00.000Z","modified":"2026-05-11T10:00:00.000Z","valid_from":"2026-05-11T10:00:00.000Z","name":"netflix-clone-omega-gules.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netflix-clone-omega-gules.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053777175304683701"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcc8b3ee-0031-5a5b-806f-02125d98da0e","created":"2026-05-11T10:00:00.000Z","modified":"2026-05-11T10:00:00.000Z","valid_from":"2026-05-11T10:00:00.000Z","name":"https://netflix-clone-omega-gules.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://netflix-clone-omega-gules.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053777175304683701"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6805535f-142f-5277-9990-b68b3f4869a9","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03103b22-a257-50c8-985f-27c7d4701bb7","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d98dd74f-ab41-5c23-98d8-673339585a39","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c885738c-8d2d-5db4-814a-b7d3bf6100b0","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9dcc2eb-1063-55da-b564-a1a5260d7345","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e916160d-c193-5c34-9bf9-7b12a59877c2","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c2bf04f-f13a-50f1-99ef-c9c7249e25f5","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2791012-f172-53c6-87e5-13722c4bfffd","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--318fd33f-612f-5ba5-8c25-f8b491c6c6e4","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8971f927-c2f8-5c9d-ba2c-c6a459ccc290","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12b2aa5c-7c1e-51b1-a390-7c4de932280f","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--295cc224-7f89-53ff-ba58-cba81afd94f0","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07c7b3ea-b043-5d94-9fed-6006a648b11a","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62181a16-590d-57ce-a893-5b81b2ae7777","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b65d0383-46d6-5dad-91bf-234a04142bf1","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"connect-sncf.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'connect-sncf.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1b5c8d6-9c98-5235-8367-c8a3ac4b6ac2","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://connect-sncf.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://connect-sncf.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7130c4dc-9fb6-5790-9ca1-936929540d56","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d33e57c3-bde2-54fb-bddd-1ed570ae7dd8","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3faf920c-10a9-5fa5-b886-0faab94ebd31","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"online-meet.com","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'online-meet.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d68d09c5-9ab3-50b5-8919-09ffe960341a","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"http://online-meet.com","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://online-meet.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62c6d667-4d6c-5436-bd70-3151b0dc234f","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"http://online-meet.com/files/update/uptodate.exe","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://online-meet.com/files/update/uptodate.exe']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9eb3b92-6452-5eda-83b4-270c35cc7494","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"8a132e7dd4876c87b5c425db32291bd54a2f3a477c78ceb4d29f297867a150fa","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a132e7dd4876c87b5c425db32291bd54a2f3a477c78ceb4d29f297867a150fa']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--104e4db8-1aba-5e37-9d79-28ad7a3a8ce5","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"http://151.243.18.254","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://151.243.18.254']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90428b31-d8e1-5aa8-a4a6-85f0838d38e4","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"http://94.26.83.199","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://94.26.83.199']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--577f0678-d78a-5dd2-bea5-678db0d965d2","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"151.243.18.254","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '151.243.18.254']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8941e633-22d4-54ef-baec-3a11d2e52302","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"94.26.83.199","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '94.26.83.199']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbcc2264-7d1f-5d9e-a452-91ec1064db48","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc9ecd08-8ac5-529b-a0fa-4776c69b6c14","created":"2026-05-11T12:28:00.000Z","modified":"2026-05-11T12:28:00.000Z","valid_from":"2026-05-11T12:28:00.000Z","name":"capture10.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'capture10.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053814460901732632"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c09e1ad-b17e-5690-9486-85f2579f008f","created":"2026-05-11T12:28:00.000Z","modified":"2026-05-11T12:28:00.000Z","valid_from":"2026-05-11T12:28:00.000Z","name":"https://capture10.com/o96zJvtiS5uZ","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://capture10.com/o96zJvtiS5uZ']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053814460901732632"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d538023b-c2e1-5b42-9cdd-15cda7e5c425","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"https://github.com/pd1-pd","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://github.com/pd1-pd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053822000150483047"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40fa8a2c-b2aa-511f-a48e-3fdd9d166b05","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"https://github.com/ud-pd","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://github.com/ud-pd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053822000150483047"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd1c9d22-c3da-5b83-810e-d23154cedf1d","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"56ff11e3d7de149ad251b6fd7e565a71","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '56ff11e3d7de149ad251b6fd7e565a71']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053822000150483047"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--772bf496-7648-5886-938c-f89fb8c2689f","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"c196e3eedb24812568521ec9cbcedf31","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'c196e3eedb24812568521ec9cbcedf31']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2051603312546594944"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a807af1d-9bca-52d8-a943-11eada56d17e","created":"2026-05-11T13:28:00.000Z","modified":"2026-05-11T13:28:00.000Z","valid_from":"2026-05-11T13:28:00.000Z","name":"74399b1d6c287ae48db67fc5e3aa5a28","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '74399b1d6c287ae48db67fc5e3aa5a28']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053829556080144482"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6426abc3-a6f5-5926-8120-414982d699c9","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://77.110.124.112","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://77.110.124.112']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--15063dda-4695-5396-bf0f-1c6bc3b4e2ae","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"iuwef.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'iuwef.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--db5f35c6-c74d-5f57-b93e-ce2a60f7c85d","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://iuwef.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://iuwef.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ab560ff-caf0-5672-ba26-746316069ad0","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"koqwh.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'koqwh.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--21ec6392-4d32-5e1c-94cd-d7b75789b357","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://koqwh.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://koqwh.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ef4abd4-3eb3-5454-8096-daad45144d14","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"lonjfq.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lonjfq.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--680674c5-8519-54da-8e94-0926a0580dc9","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://lonjfq.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lonjfq.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--61e17b70-2c7b-5a61-baf9-16ca01945c83","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"77.110.124.112","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '77.110.124.112']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--647d8194-de00-53d7-b93a-d5288f02c913","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://86.54.25.202","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://86.54.25.202']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9ea5dc6-9ad9-59e7-9dba-87850cf389e0","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://86.54.25.204","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://86.54.25.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--69128c45-1c94-57a0-ab4b-68e34cadd9c7","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"86.54.25.202","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '86.54.25.202']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd49a93b-0f9e-5d2c-a167-7444289536da","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"86.54.25.204","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '86.54.25.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4158df9a-140e-52fb-9a32-ecad74ed121f","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"ndigitals.in","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndigitals.in']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4072e5d3-ae8b-5032-b6ad-d7058edcea07","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://ndigitals.in/payloadvbs.b64","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ndigitals.in/payloadvbs.b64']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1018ef49-4686-5e14-819a-ec38b27eb291","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"morrismusicltd.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'morrismusicltd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1e18e42-8629-5807-bfe1-b49cb9b0e61d","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://morrismusicltd.com/report-proeval.php","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://morrismusicltd.com/report-proeval.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb59374-e754-5312-aea0-28078293ec86","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"vothequine.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vothequine.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7e3612a-ae61-5ae2-b1bb-13f493fce7ba","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://vothequine.com/sunrise.txt","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://vothequine.com/sunrise.txt']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--865c4684-c991-5106-a2df-3164bbee1c2b","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"smartheartboardgame.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smartheartboardgame.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa7b3d9f-0b73-5878-b06b-526a4aa0d495","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://smartheartboardgame.com/report-proeval.php","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smartheartboardgame.com/report-proeval.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e261828f-3db1-5eb7-b643-d3eda4b881f4","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"ristorantezago.it","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ristorantezago.it']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8d11fe9-df27-5e3f-8cda-ba5e06d4e9fe","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://www.ristorantezago.it/sunrise.txt","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.ristorantezago.it/sunrise.txt']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--525d01a8-c40b-5f78-a717-1ade57cf72c1","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b90dcf50-81f8-5d39-a96e-378dd0b6314b","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"8b7d9c3085decba6895528bc26003059c779ede983e24f629c26d867f58edcb9","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8b7d9c3085decba6895528bc26003059c779ede983e24f629c26d867f58edcb9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f33b768-b834-5f58-b43b-38603342eb52","created":"2026-05-11T14:00:00.000Z","modified":"2026-05-11T14:00:00.000Z","valid_from":"2026-05-11T14:00:00.000Z","name":"onlineicloud.support","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'onlineicloud.support']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053837577736618133"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adc417bc-14e4-5461-abbd-50e7b7919b59","created":"2026-05-11T14:00:00.000Z","modified":"2026-05-11T14:00:00.000Z","valid_from":"2026-05-11T14:00:00.000Z","name":"https://onlineicloud.support","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://onlineicloud.support']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053837577736618133"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e90bf08-ee99-5ab6-af3d-8a22cd319f4d","created":"2026-05-11T14:01:00.000Z","modified":"2026-05-11T14:01:00.000Z","valid_from":"2026-05-11T14:01:00.000Z","name":"http://146.103.106.59","description":"IOC reported by @RussianPanda9xx on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://146.103.106.59']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RussianPanda9xx/status/2053837915185111061"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7306270b-92ac-5cca-9dd5-67a1ca421f6c","created":"2026-05-11T14:01:00.000Z","modified":"2026-05-11T14:01:00.000Z","valid_from":"2026-05-11T14:01:00.000Z","name":"146.103.106.59","description":"IOC reported by @RussianPanda9xx on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '146.103.106.59']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RussianPanda9xx/status/2053837915185111061"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2076982b-e8fd-5c89-81c7-eda2a22b6118","created":"2026-05-11T14:45:00.000Z","modified":"2026-05-11T14:45:00.000Z","valid_from":"2026-05-11T14:45:00.000Z","name":"hotel-stay32181.com","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hotel-stay32181.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2053848962306572344"}],"labels":["booking","phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ac0936-bc36-5772-a513-ab1d0bdfdd05","created":"2026-05-11T14:45:00.000Z","modified":"2026-05-11T14:45:00.000Z","valid_from":"2026-05-11T14:45:00.000Z","name":"https://hotel-stay32181.com","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hotel-stay32181.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2053848962306572344"}],"labels":["booking","phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e848bec-929c-57ae-b017-ac8d33878483","created":"2026-05-11T16:00:00.000Z","modified":"2026-05-11T16:00:00.000Z","valid_from":"2026-05-11T16:00:00.000Z","name":"briuoqrakq.firebaseapp.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'briuoqrakq.firebaseapp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053867795616579759"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--381814e7-ffba-5df5-a7e3-c62efd141774","created":"2026-05-11T16:00:00.000Z","modified":"2026-05-11T16:00:00.000Z","valid_from":"2026-05-11T16:00:00.000Z","name":"https://briuoqrakq.firebaseapp.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://briuoqrakq.firebaseapp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053867795616579759"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--126a6254-1029-51e5-9f48-10999fc2564b","created":"2026-05-11T16:21:00.000Z","modified":"2026-05-11T16:21:00.000Z","valid_from":"2026-05-11T16:21:00.000Z","name":"ins-tagram.com","description":"IOC reported by @tobersotski on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ins-tagram.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/tobersotski/status/2053873168721334344"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dfaa99e-a971-5dd5-965b-731fd0a91808","created":"2026-05-11T16:21:00.000Z","modified":"2026-05-11T16:21:00.000Z","valid_from":"2026-05-11T16:21:00.000Z","name":"http://ins-tagram.com","description":"IOC reported by @tobersotski on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ins-tagram.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/tobersotski/status/2053873168721334344"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e302f6a-0bb9-5af8-8682-41e6b7c45c1f","created":"2026-05-11T16:34:00.000Z","modified":"2026-05-11T16:34:00.000Z","valid_from":"2026-05-11T16:34:00.000Z","name":"ne12bradesconetempresapj.com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ne12bradesconetempresapj.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2053876482544488938"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9398d220-e643-550b-b8c4-674863a067a4","created":"2026-05-11T16:34:00.000Z","modified":"2026-05-11T16:34:00.000Z","valid_from":"2026-05-11T16:34:00.000Z","name":"https://www.ne12bradesconetempresapj.com/acesso-seguro.php?token=1325787116a022c49017d69.66885194","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.ne12bradesconetempresapj.com/acesso-seguro.php?token=1325787116a022c49017d69.66885194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2053876482544488938"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21de909c-11b8-53fc-a61b-946e6fe3615e","created":"2026-05-11T16:34:00.000Z","modified":"2026-05-11T16:34:00.000Z","valid_from":"2026-05-11T16:34:00.000Z","name":"181.214.221.46","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '181.214.221.46']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2053876482544488938"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4be993e0-755d-5e15-948a-2f6bc25a73d6","created":"2026-05-11T17:27:00.000Z","modified":"2026-05-11T17:27:00.000Z","valid_from":"2026-05-11T17:27:00.000Z","name":"mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053889768879206643"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af8116fc-e0c3-514c-b0c8-fde8be647100","created":"2026-05-11T17:27:00.000Z","modified":"2026-05-11T17:27:00.000Z","valid_from":"2026-05-11T17:27:00.000Z","name":"http://mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com/com.php","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com/com.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053889768879206643"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15386c3c-2a68-550f-87e3-d359d4524d19","created":"2026-05-11T17:27:00.000Z","modified":"2026-05-11T17:27:00.000Z","valid_from":"2026-05-11T17:27:00.000Z","name":"b956e00320c4d41e5122a9a94d7cd03f4d5b109b64fc84ccccc777042df65738","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'b956e00320c4d41e5122a9a94d7cd03f4d5b109b64fc84ccccc777042df65738']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053889768879206643"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a434f45a-2135-5cfa-8b3b-9d7de47e84ef","created":"2026-05-11T17:46:00.000Z","modified":"2026-05-11T17:46:00.000Z","valid_from":"2026-05-11T17:46:00.000Z","name":"mcabinnesotaimplangroup.vu","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mcabinnesotaimplangroup.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053894478675783712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15988709-3672-503d-843d-96791a976da8","created":"2026-05-11T17:46:00.000Z","modified":"2026-05-11T17:46:00.000Z","valid_from":"2026-05-11T17:46:00.000Z","name":"http://mcabinnesotaimplangroup.vu","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mcabinnesotaimplangroup.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053894478675783712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62c195d1-058f-5ef7-a855-6f856619a2cb","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"mailnotice008.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mailnotice008.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053897976167195099"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71909647-5173-50d3-a308-0b7911184f42","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"https://mailnotice008.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mailnotice008.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053897976167195099"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe87da60-d0ea-5f9b-a09f-b9f825b07dc0","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"nid-navernet.onthewifi.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-navernet.onthewifi.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6029cd88-0125-5d18-bd27-44cd0cbf1837","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"http://nid-navernet.onthewifi.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-navernet.onthewifi.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb6d949-690e-570f-9326-f47d4e3ea1f8","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"http://27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c41e64fd-bb60-5e1c-a8ea-f62b098b645e","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d2b325a-91ab-5a9b-a948-8e88ab31ce16","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"updatesubs-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'updatesubs-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24f0f36b-94f5-5b0d-8d3d-6492b7061926","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://updatesubs-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://updatesubs-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f88456e4-50dd-5ef7-94b7-923d238532ca","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"member-area-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'member-area-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e63eed89-94cc-5952-9226-e3e571db3123","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://member-area-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://member-area-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--045a5f2b-103b-58c2-8ac6-f9eac1ecd637","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"netfilx-account.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netfilx-account.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c30c0357-42ca-5029-a60a-6b33f2d18adf","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://netfilx-account.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://netfilx-account.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9cc6de1-6a87-5016-a1ee-cce4784bf14b","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"netfilx-rejoin.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netfilx-rejoin.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef0704cd-be8c-5aae-8d6e-c65ffd8f6bf9","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://netfilx-rejoin.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://netfilx-rejoin.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db58082f-d8d4-5d78-88b0-af87ba8d2373","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"netfilx-membership.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netfilx-membership.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7728a5f0-34a1-5cad-b9d3-d1e7f976de21","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://netfilx-membership.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://netfilx-membership.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b5d1bc2-a662-5442-8d98-8906e6384347","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"my-etoll-service.vineluxe.store","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'my-etoll-service.vineluxe.store']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4698bf1-4350-537d-82e0-72909fba8925","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://my-etoll-service.vineluxe.store","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://my-etoll-service.vineluxe.store']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1220509-29d5-5865-91d4-9de0305de7f7","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"e-zpassiags-april.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-zpassiags-april.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29176ad9-816b-5a79-9130-60a2f15983ef","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://e-zpassiags-april.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e-zpassiags-april.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98329a68-420b-56d8-bad1-26dda983aeb1","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"jangenam.ooguy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jangenam.ooguy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e844af0f-5933-5df8-8111-dce496cc0405","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://jangenam.ooguy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jangenam.ooguy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7340a07-2e21-587a-bdf7-1ccb1d978c78","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"ezpassiags-march.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ezpassiags-march.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1c80ef8-8c4e-56bd-884d-f03fd77463b4","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://ezpassiags-march.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ezpassiags-march.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d553525-dc33-5fe0-bc02-d180a4d6b281","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"etoll-ezpass-notify.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'etoll-ezpass-notify.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24b9b70d-6767-572b-9e96-ad6da5a1e38f","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://etoll-ezpass-notify.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://etoll-ezpass-notify.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c279439-e6e4-5552-a7db-0321413a40d1","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"etoll-blling-ezpssiags.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'etoll-blling-ezpssiags.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adc3b6c0-64e9-58a2-908f-c09bb340850a","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://etoll-blling-ezpssiags.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://etoll-blling-ezpssiags.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acae64e8-ce7d-522a-aff7-321fad129e15","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"ezpssiags-etoll-02.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ezpssiags-etoll-02.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a10cb89-c86a-55f9-b0d8-b9ce7d267be7","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://ezpssiags-etoll-02.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ezpssiags-etoll-02.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7b6eec9-afcf-51ad-b5f0-f34ba8262160","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"ezpssiags-bill.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ezpssiags-bill.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a31029f-bb0e-50a9-b7c4-f1f4fbb45e68","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://ezpssiags-bill.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ezpssiags-bill.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89b5c883-fbc8-5e06-b9e8-7d1788e799e5","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"etoll-ezpssiags.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'etoll-ezpssiags.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ac610ba-033c-5993-b6f9-7d5863b9c0c4","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://etoll-ezpssiags.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://etoll-ezpssiags.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ff3c03c-0b3d-5248-8453-835b6f7b6da3","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://150.136.252.61","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://150.136.252.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ef84dee-b97a-51b6-aec1-355d9db9ce89","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"150.136.252.61","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '150.136.252.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a34c44b8-30cc-5c0e-9de7-af4a2e462161","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"http://142.171.160.137:8888","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://142.171.160.137:8888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbc5133a-217e-57cc-a235-84f768361be3","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"142.171.160.137","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.171.160.137']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c1d11c-bcab-52df-828e-ab3a9d7a8d43","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"142.171.149.169","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.171.149.169']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4976b5d8-909e-5b90-8ce9-7ca6d53d36f5","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"100.81.245.29","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '100.81.245.29']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d054d4a4-90da-5870-ae8c-b9c1173b6cdb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmpoemqnmpj.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmpoemqnmpj.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b9a4b56-ea99-52ce-8762-57753047f8f5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmpoemqnmpj.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmpoemqnmpj.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--800b675d-5381-5555-bcb8-b1b790cc990d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imlbioxai.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imlbioxai.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d25c5f2d-a89c-54f1-8c58-1aa25d56ab55","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imlbioxai.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imlbioxai.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3e729f2-d2a0-520d-8d52-a339a94d7765","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmqgollpaij.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmqgollpaij.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fda142c-a7fc-57ff-906a-b3cc5ea16df6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmqgollpaij.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmqgollpaij.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ab01c1b-2852-594f-b075-86f3bad04acb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmyappwlwza.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmyappwlwza.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98fc17a7-dce3-5883-babd-79282306c89a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmyappwlwza.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmyappwlwza.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1feeefe-dfff-5ab5-bf6d-73fe7257c887","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmvxsybqika.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmvxsybqika.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3425720f-cb2a-5cc9-8839-4f28b2c570d3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmvxsybqika.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmvxsybqika.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c620406-5eae-5068-8651-9d98f67c9f8a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmmdkbebist.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmmdkbebist.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--118be536-2842-5a52-b13a-c7a6c245df3a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmmdkbebist.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmmdkbebist.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07d8363b-51a8-50a7-bb06-6bf21932b19f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmvtckrtdus.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmvtckrtdus.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b28fe1bf-0385-5290-bc22-155fb1a067d4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmvtckrtdus.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmvtckrtdus.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0963b1fd-e30a-5766-a698-e175e77bc610","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmfrpejvtno.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmfrpejvtno.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2cf1480-726e-539c-9ae2-d3dfae17288a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmfrpejvtno.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmfrpejvtno.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--484316f0-6717-5737-89ab-173ea7521d6b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmiwoyseqiv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmiwoyseqiv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46330670-86bd-5d29-90c2-770465645eb3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmiwoyseqiv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmiwoyseqiv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01762379-6621-5378-9dcb-546c170f2bac","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmezzkwochd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmezzkwochd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--beca453c-70a8-5447-acf2-022ce25c85cd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmezzkwochd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmezzkwochd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff56044a-d582-5423-8bda-01dc9037376d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imboeznibuk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imboeznibuk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dde74601-04fa-5258-a6ff-dd8a230d6007","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imboeznibuk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imboeznibuk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82505cf8-cba6-57e5-81c3-924296028413","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imtzdrlecxv.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imtzdrlecxv.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3ba3e24-f730-5331-a531-5a05e9c54ea8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imtzdrlecxv.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imtzdrlecxv.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--022ae418-e177-53b3-b2ca-d1c270e13d84","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imvfptssn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imvfptssn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05b8d5da-326d-59b2-af30-dc50f5063391","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imvfptssn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imvfptssn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cf4e3db-b0ce-5b4b-8acf-0bab27199858","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzmfkbbsewp.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzmfkbbsewp.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58765b6b-afe0-5dc4-a4ed-710b3a064c35","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzmfkbbsewp.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzmfkbbsewp.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--287ab754-527e-5afd-b5b5-a23af9f29def","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzvenuidipk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzvenuidipk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22a5b06b-5d59-5a80-a8c6-bc59b76edabc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzvenuidipk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzvenuidipk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f6d433f-ecb4-5312-bec5-27afb25dafa1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzrgwbmxiuj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzrgwbmxiuj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e1d4142-82a5-548b-8fe2-57332f86f8b5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzrgwbmxiuj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzrgwbmxiuj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03960af0-d89b-530f-8282-31d85beb8e89","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzsnlfjbutu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzsnlfjbutu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cc3cee0-e3f5-574f-8554-40616e4f36bd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzsnlfjbutu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzsnlfjbutu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--156646d5-b005-5687-a734-f768b4172c05","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzbvmihrfuq.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzbvmihrfuq.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b4f1dfe-a7b4-5547-a9b7-7c3483f17561","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzbvmihrfuq.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzbvmihrfuq.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcd1931c-43be-544d-86d1-fd816456440d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzvuhwepflo.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzvuhwepflo.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b18f582b-f91e-5ff7-a064-2ae35a39bcd8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzvuhwepflo.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzvuhwepflo.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c42d2d96-b00f-50ae-98c0-4f1080631c76","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzsimgxmjse.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzsimgxmjse.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67a5c2ef-fdf2-5ada-9332-e620b2045cb1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzsimgxmjse.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzsimgxmjse.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7799800-848f-5a84-9af3-2ca16ed5ba87","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzhaeuhucba.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzhaeuhucba.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c553d624-ee14-545b-af21-4eec25ec9a8f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzhaeuhucba.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzhaeuhucba.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebc190e3-1789-50ef-862f-37d41a92a7f0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzfznmyeovb.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzfznmyeovb.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42b0c3af-78e7-5c6d-9842-adfce9ddd99b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzfznmyeovb.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzfznmyeovb.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc16127a-c044-5198-a008-6586d6d1de38","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzomshrstkm.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzomshrstkm.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--477224b4-dea8-5fc3-8063-72891f38d323","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzomshrstkm.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzomshrstkm.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd22130d-70f3-5de4-931a-ea029a3ebbef","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imyflphhjqu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imyflphhjqu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a7cde8f-eedd-58b1-9404-10e9578f9c6c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imyflphhjqu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imyflphhjqu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8970a5d0-1cfb-53fa-9198-7df823b064c7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imweqtnvyqw.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imweqtnvyqw.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d1b89d-ad4f-5e99-88ab-09aa03c86d86","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imweqtnvyqw.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imweqtnvyqw.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--784641ee-51c0-5aa6-b623-850517669fa0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhsvamtlso.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhsvamtlso.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3b05606-1583-5e99-a592-a3b1cbb3c8b1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhsvamtlso.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhsvamtlso.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07ce300e-3e84-5830-8553-6a98149f18c6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhyuyzlmix.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhyuyzlmix.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aad5dc39-42aa-549b-b45f-bddb0dcaecda","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhyuyzlmix.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhyuyzlmix.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c44578ef-8383-5c50-98d2-f4f6392c11c3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imxdxzhmtju.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imxdxzhmtju.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f21ba838-feaa-582b-a729-0095a2d81ef1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imxdxzhmtju.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imxdxzhmtju.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d23ed644-47c0-5c0c-86a6-2f9294d6ed10","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imnxofrpdik.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imnxofrpdik.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82d32ff2-0952-5b36-9351-c43b4aab5e58","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imnxofrpdik.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imnxofrpdik.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34ce6f9e-3c1d-59fa-8e31-9d265032f013","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imiiuyuvhfe.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imiiuyuvhfe.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7946fcee-dc6d-53c7-b97f-93decfb2efdb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imiiuyuvhfe.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imiiuyuvhfe.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9f75c8f-4e0d-5a43-85be-dd90b267922b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imypevsnxap.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imypevsnxap.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ea8825c-5a74-5de5-b377-bb762187d914","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imypevsnxap.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imypevsnxap.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02e5ceab-d99e-5f9e-a17c-56766ff65cc3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhsiexkoyz.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhsiexkoyz.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d48e7c-fc5c-5d80-8b11-107315c52f32","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhsiexkoyz.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhsiexkoyz.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2db7ccbe-2a5f-5a7a-8671-a3521bdefede","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imorelrlvgj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imorelrlvgj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7864eae-8749-5c14-98f2-8fd413082e3d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imorelrlvgj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imorelrlvgj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86c7b73e-06e9-5998-8037-fa710b53b450","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imlqzydpehu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imlqzydpehu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb6495fe-9e27-5f3a-b110-e2d59ebe9ad6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imlqzydpehu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imlqzydpehu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f9bfef1-431d-5913-8607-47b40954e1b6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imnnaghfftl.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imnnaghfftl.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03d08577-ee0f-5383-ac77-d9167c6de8c2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imnnaghfftl.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imnnaghfftl.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--087999d2-941f-50e9-8c38-f3e88567ceb9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"impolsmes.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'impolsmes.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bad33c4-974a-5138-b03f-97f95bafb446","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://impolsmes.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://impolsmes.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca139711-1dd5-57b6-aab2-1e60b5a95e46","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imltrdtzo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imltrdtzo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--530bdeaf-8037-5f64-8d1a-77968cbc5cfb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imltrdtzo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imltrdtzo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--717fe050-50e1-5ee1-9af5-0cd3018919e4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhpqwwma.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhpqwwma.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46d9ccf1-7115-5bbb-92ae-36e0ddf16c3d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhpqwwma.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhpqwwma.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce021e54-0692-59f2-bb20-13756e987082","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imeij2jof.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imeij2jof.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29ab1e4b-9822-5a88-be64-528bc4fb8aaf","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imeij2jof.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imeij2jof.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7c5361e-8f64-5747-9837-3ae0dffe98b8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imnrhbcpg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imnrhbcpg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe39fb67-6454-56e7-86d6-92471d40ab4b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imnrhbcpg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imnrhbcpg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4b05fe8-7a41-5ce4-a069-29baea13145b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imqkodvnh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imqkodvnh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff9347c8-d176-5859-8de5-cad9984ddeb1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imqkodvnh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imqkodvnh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f17e361e-f06e-5efd-9b03-b6de448e279e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imawiirlf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imawiirlf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44239f23-0436-526d-96a5-8e58cee0f967","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imawiirlf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imawiirlf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d02463ce-7c78-5d4b-abe6-e144479b2803","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imdildckx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imdildckx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f5410e9-0c1b-5a8d-95b5-4dedb8ad31e5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imdildckx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imdildckx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eefc789f-2dce-5d42-b4e9-10e80f203ee1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imfueakgr.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imfueakgr.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c33c4ca2-6ec7-50eb-a7d7-49b78f337048","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imfueakgr.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imfueakgr.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--216ed232-8a9d-54ba-989a-2b0c38f1cd8b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imeqlvedp.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imeqlvedp.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c96ca4de-e510-53d3-9220-2a8b4ed8e881","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imeqlvedp.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imeqlvedp.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d15ff38-19d0-563d-92c3-0bb34f59df0b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzrutppj.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzrutppj.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--952d8df9-08be-51a4-b1d6-2fbaa58dbd68","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzrutppj.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzrutppj.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9577d6e-58e1-590e-897e-2823a540b997","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imwywutdl.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imwywutdl.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--419f27b1-71b0-53f4-a3f6-70c8636fffe1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imwywutdl.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imwywutdl.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e29ad360-4d7f-59ec-990f-c5fa13bae047","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imofwmyzu.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imofwmyzu.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c65e5ace-074b-5a35-83a7-e114abf0a7a1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imofwmyzu.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imofwmyzu.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9db6db4d-396f-5a1d-bee3-bea9e3800eab","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imklevubf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imklevubf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34410625-2864-5cd6-81c0-6c52156e5bf1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imklevubf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imklevubf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe6ab11b-ee92-561a-a718-b041e2edd093","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imwfbmotn.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imwfbmotn.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--146644d7-36b4-5eab-84ca-43d8e40e7d28","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imwfbmotn.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imwfbmotn.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7df04a25-9598-5107-8680-054f3c26377c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imuvtahho.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imuvtahho.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7833d61-e628-5631-b7aa-e64600026375","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imuvtahho.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imuvtahho.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44bdc968-4616-516f-b0af-8b20fae9acae","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imqyeosse.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imqyeosse.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8bf1a6f-baaa-5f59-bad0-67dbc778f443","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imqyeosse.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imqyeosse.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--456a11e5-b981-51bb-bb93-eee675111655","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imkxrlawh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imkxrlawh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--841bee73-720e-5e71-95f4-30b24bd3ab07","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imkxrlawh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imkxrlawh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a10b8c5b-d0bc-558f-9a50-03c735335cb9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imgkbwcaa.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imgkbwcaa.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98e8e909-2729-5cb4-9519-a2d64ebf37d0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imgkbwcaa.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imgkbwcaa.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53090444-3c51-5eed-ac96-7c9b928e965d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imevznwcg.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imevznwcg.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b025f6b-f154-5460-9ddc-b21a3535f48d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imevznwcg.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imevznwcg.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b9fbcb1-e103-5b90-a482-460295fa920d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imewesroh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imewesroh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8912f788-26be-5ca7-8044-488418ef597f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imewesroh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imewesroh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ba9437d-3875-525c-b8d6-ef2cda3e73ab","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imacfgmbf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imacfgmbf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5d30b61-0fe3-5d10-b64c-0f696cb9b613","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imacfgmbf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imacfgmbf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f59fa26f-6d60-5c25-b704-0666738701e8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imeasniku.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imeasniku.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f70a6272-7742-5f51-8f04-323ff70cbe50","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imeasniku.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imeasniku.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9098838-4803-5050-a812-137b3d84429f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmxpybvuc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmxpybvuc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd0c086f-bad2-52e6-8ebb-c3f387e162f3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmxpybvuc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmxpybvuc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb842801-41f6-50c3-83a8-2e9b87e9012b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmhszflpi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmhszflpi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--082769c3-bc10-51e5-b69b-a7c1d0b329cc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmhszflpi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmhszflpi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34394504-3bf7-57d5-8621-c761e6db2ab6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlgnwldm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlgnwldm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e53fcfb2-88cb-5ec7-927e-4ce95f815446","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlgnwldm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlgnwldm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e82e51f-99cb-5215-92db-b8a68f5a6b29","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmmslgieh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmmslgieh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55d7a67-8939-51ff-81c3-e4fc1eeff194","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmmslgieh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmmslgieh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef1aa08-a590-5669-9094-ee3f6c22fdd1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmxazemwg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmxazemwg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f645bf3-2a2c-54a0-b9e1-f0f7bd843bc0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmxazemwg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmxazemwg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ba39be2-5155-5222-8c9d-1b6c1021986f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmitjxofe.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmitjxofe.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--960f3b90-4a71-5943-89b9-aead61b8fa45","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmitjxofe.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmitjxofe.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--141500ad-04e3-5ab7-81e9-b43d05920eb0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlvlkmrx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlvlkmrx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4388a145-d58e-5dca-a6e7-052cd51cafff","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlvlkmrx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlvlkmrx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56fa2cd8-84b1-5f8f-8248-4e9c9fe74604","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmdihnrqd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmdihnrqd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--022b5392-8ac4-5d78-a5c6-eaa95799615c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmdihnrqd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmdihnrqd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--053b1a5c-781f-533f-8a8a-5a01dbe179a9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlxyvdfd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlxyvdfd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0601fd4-c703-59a9-b1c8-4f143b47635e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlxyvdfd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlxyvdfd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f86f2b0-34f5-526d-aea8-8cd66ceb7e51","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmluuuyqv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmluuuyqv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a0c9774-5c97-515d-b284-9c98a8816226","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmluuuyqv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmluuuyqv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dad5f0c8-89ee-57f1-98f2-8e30298baa66","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlicoxiy.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlicoxiy.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20c3db4e-89c3-50b4-8148-0e9dda25db58","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlicoxiy.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlicoxiy.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9e22d6f-ff88-5596-bc87-ae2285291528","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmpavordl.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmpavordl.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f63be246-3693-5b8a-be16-3dcc0ca66aa8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmpavordl.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmpavordl.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e471e109-bf66-536d-89d6-52eba52771b6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmpzzjggs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmpzzjggs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1516122b-56e8-568b-a1c6-61b6129f3c43","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmpzzjggs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmpzzjggs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc91eb8a-c782-53c3-a90e-2efd83ea517a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmvrbxkgs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmvrbxkgs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c3102ce-75df-5fb3-9f7b-59f8a3099ffe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmvrbxkgs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmvrbxkgs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--521849b2-7d13-5769-889b-067f7cddc6ed","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmqmrttdo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmqmrttdo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52260713-0d0f-5a90-85c8-3e4127eab023","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmqmrttdo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmqmrttdo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9f5ab22-a894-5ad1-a493-9da68bb36790","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmgysllbn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmgysllbn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ce0f481-ea4b-55e1-a92f-97e742fc867e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmgysllbn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmgysllbn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f0a63a6-9ce0-541f-875e-99203c76e526","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmbjutevk.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmbjutevk.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ae6434e-bd91-5d06-8cfa-0a6a557b0bbc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmbjutevk.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmbjutevk.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--371a3a8e-b030-53bd-843e-aa02b6d92c7d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlojxudi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlojxudi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba003de5-ff87-5327-83a2-038935f51ab2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlojxudi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlojxudi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d9a166-4a7c-51d5-bb53-d84700acedd9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmalfgloi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmalfgloi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cafbf246-657b-5596-a41e-83e42086c4e2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmalfgloi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmalfgloi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9195ca3c-c3b9-565f-9dbf-d65574bc7680","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmaiyvhxx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmaiyvhxx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--964e90cd-3d4d-54bc-9a8b-9f2182908d87","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmaiyvhxx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmaiyvhxx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e78d764-ad25-521e-a2ca-24dbc1475f01","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmshyqlvd.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmshyqlvd.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd46c997-d9d0-5ecc-ae14-1b1b7ba47e7d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmshyqlvd.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmshyqlvd.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26126a71-0e77-53e4-b688-460c1c6af242","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmpomqnzl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmpomqnzl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03448f12-bac5-57dd-8fb4-856fef0a51de","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmpomqnzl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmpomqnzl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9cc2635-511a-5c2e-882a-a0ad5f87d2d1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmrtuleuq.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmrtuleuq.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfaae312-23e3-52d7-811f-f031b7015b7f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmrtuleuq.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmrtuleuq.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db79c681-d0a7-5558-b1e3-5050ffe10956","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmnqgrdvi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmnqgrdvi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--addb9cba-e80b-59ff-bb51-8454bacea26b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmnqgrdvi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmnqgrdvi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37305010-5768-592d-841a-f04ef4b39b1a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmypfihui.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmypfihui.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66f63e99-be4a-5565-8559-94e8ed59ebbc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmypfihui.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmypfihui.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5015cc98-04d3-5ec1-93f7-b42ec049e62a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlwykhre.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlwykhre.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a564734-1c93-5931-977a-e5e450ba847c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlwykhre.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlwykhre.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--968da71a-439b-565e-ace9-45d815752b3b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmhlfzokh.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmhlfzokh.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05290247-8442-5ddc-8779-64d22fe416dd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmhlfzokh.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmhlfzokh.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4d3dcbf-dbe0-57f1-ab34-d26cf08b1a71","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gseminuko.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gseminuko.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fccc606-6f99-5183-99bb-b4a0cbc7e208","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gseminuko.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gseminuko.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--402d27ce-3301-5304-93a8-6510937d6521","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmnwdhnupf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmnwdhnupf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2c0e3fe-e932-5fcc-b6e5-ac161f2a50d9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmnwdhnupf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmnwdhnupf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1446c885-acc1-5f9a-9af9-1fa176ff8d07","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmjryqloxn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmjryqloxn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb51a11e-a821-5569-9f68-e57de7805be3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmjryqloxn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmjryqloxn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfff3411-7c44-5a23-9711-d8911e9df9b2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmvbchibgq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmvbchibgq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e71a78dd-f084-56b3-8900-71ed2428becb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmvbchibgq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmvbchibgq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a558cc-2de1-5ba8-8b22-8466cdd452ef","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmhbilzscs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmhbilzscs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c254869-e837-5dd3-9876-e845ae122ffe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmhbilzscs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmhbilzscs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d786bc57-7c7a-5b42-a44b-8cc3f866e39e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmycyrkwsq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmycyrkwsq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2634c8cd-f15e-5214-b12b-a2d4dc0dafdc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmycyrkwsq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmycyrkwsq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--210d9a98-8cb2-59c8-bd5b-b234bbe25886","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmeinuljww.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmeinuljww.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c477f544-c611-57a2-9b8c-d43f260efadd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmeinuljww.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmeinuljww.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7d0e7a1-6e63-5768-a428-d6a32b2eacfd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmgwuancky.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmgwuancky.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--019b0f84-c6d8-5cb4-9b3b-42e2bda9d762","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmgwuancky.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmgwuancky.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a00019fa-392d-5515-b6d4-77ca526a58db","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmdqriyusm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmdqriyusm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed440d35-5743-5967-aee6-a4503e992cc5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmdqriyusm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmdqriyusm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6c904b5-b193-557b-b02c-c32a9061b832","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmfvuwioeweh.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmfvuwioeweh.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4cf7709-becc-5193-ad0c-6f31c64fa8b3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmfvuwioeweh.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmfvuwioeweh.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad9291b4-9ff3-54da-ab71-4f52cf4fe389","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmgwuahbji.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmgwuahbji.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb59e44-b403-581e-981e-4851c00b0214","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmgwuahbji.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmgwuahbji.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d5a266e-610a-579e-82b8-fdad8df4bdc0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmbxacmels.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmbxacmels.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef90042-7e2e-5bc2-a134-e15528de6ccd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmbxacmels.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmbxacmels.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a72a24e-44f5-59f0-b206-2d1db2118295","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gpointedinfo.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gpointedinfo.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de9e5dd-7eb9-5ee1-87d2-18152ba40fe8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gpointedinfo.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gpointedinfo.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2523070b-99a0-5104-810d-fa1bfc54252f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gpotmains.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gpotmains.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--901876eb-a908-5159-ae49-a8507cebb9d3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gpotmains.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gpotmains.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b760978-6c13-5970-a1ff-466324b388bb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fpericyjin.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fpericyjin.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3cc21a6-9aa8-56b0-962f-dad4eb0c038b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fpericyjin.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fpericyjin.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4320fa17-4343-54e7-b67b-8dc08f25e49d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"folkd9info.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'folkd9info.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8835b3d-dada-5ed7-a4b0-ec181a590f2f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://folkd9info.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://folkd9info.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97cb7f3a-9418-5f95-8872-eb54ec1c19f6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"flexinfon.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'flexinfon.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49f7824f-2ce8-550b-8523-14d70c3fa993","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://flexinfon.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://flexinfon.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6f543bc-0a20-50ba-bac9-d9d96b2c4a25","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fkonsqilz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fkonsqilz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a486e4f-75e2-5d16-a24d-2cd79101f999","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fkonsqilz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fkonsqilz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17941875-265a-51d0-a546-ea234c9e3da4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fisnispull.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fisnispull.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce8f8d48-3088-5f92-9063-1e42c3d0115d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fisnispull.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fisnispull.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a82a820c-6293-527f-a2ab-858cd882102b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fhozinftei.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fhozinftei.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ba28c9e-9ff3-5874-a7f7-0e2c31ec94ad","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fhozinftei.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fhozinftei.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--622de4f6-93ec-5f04-8b40-e3b5d92de548","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eonse71hc.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eonse71hc.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63f60a6a-8b0e-5e06-b5be-1e0e84574e09","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eonse71hc.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eonse71hc.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93269fdf-1c4e-5b37-b803-9dcfe9d356b2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fhopcixim.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fhopcixim.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dadb9761-b317-5a04-a38a-06480a0f8179","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fhopcixim.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fhopcixim.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48051202-d83b-53e5-94fb-cdf3c8019203","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fearinronz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fearinronz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56954d24-a0b3-55e4-948c-ea2c88e67f07","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fearinronz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fearinronz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--484108aa-c3bf-5a2c-959c-816465ef243e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fcaset29.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fcaset29.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f3af1db-ddb3-5938-8543-fd11e1880ec4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fcaset29.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fcaset29.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31f94461-9605-545c-8cd4-2e9d1063046e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"epa12cdiq.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'epa12cdiq.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89238fbc-8927-5908-8d10-b8d5b40f754e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://epa12cdiq.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://epa12cdiq.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--959d8a22-a98f-5f00-b51b-184d8563af9e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ec8yxeon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ec8yxeon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43da6fee-2b9c-5b84-8fc3-8fb1cfca20df","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ec8yxeon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ec8yxeon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09a46f03-0b4a-5908-8c18-de52d891207e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"edn8uo7z.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edn8uo7z.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b43bb69d-1476-534b-a306-ecceac4cc517","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://edn8uo7z.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edn8uo7z.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd911ca3-afa7-518c-b133-e828330ffc64","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eo90boios.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eo90boios.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6350e48-92db-57ed-a95c-1d219c149bb4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eo90boios.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eo90boios.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--865cda2c-1cb5-5a8d-8bf6-86387cf3674d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"e1ia92c90tz.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e1ia92c90tz.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1962a6be-1e4d-5799-aece-cc13223d14e9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://e1ia92c90tz.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e1ia92c90tz.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--706d8bb3-1804-59b6-a59a-dc64754a3d13","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"einfa8a30.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'einfa8a30.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7365ef04-4d1a-5a07-a136-8802b9e96dde","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://einfa8a30.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://einfa8a30.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--963a8f34-f419-5d02-ae8f-c0749c556d30","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ef125dioaz4.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ef125dioaz4.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d00588fd-0ed9-5486-a709-9e205ba0510c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ef125dioaz4.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ef125dioaz4.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7d27d4b-78e5-535e-8907-c66f7ed8431f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"evisin193.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'evisin193.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c54f464e-19cd-5a20-9b4f-9fcba2259cd4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://evisin193.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://evisin193.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1de01ed7-4fa2-5c8b-896c-fb3fc0668a2a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"esimdgit1.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'esimdgit1.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--360b805b-9b3a-518a-892c-243716cf07b0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://esimdgit1.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://esimdgit1.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cf8094a-a4bd-5da7-b1ae-e180850dc3ee","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"daurora.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'daurora.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26b91549-3b94-5fe7-82bc-f43130dec81a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://daurora.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://daurora.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9e6fa7e-6bd5-541d-939b-9acbd0fd6afa","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dtickaree.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dtickaree.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c600466-ec0d-51a6-9e69-fdc37af496a1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dtickaree.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dtickaree.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc1af65b-7174-5589-bef4-0f52110cea77","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"duxopenor.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'duxopenor.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13d24792-f365-5952-a30e-4f70cefc5ebe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://duxopenor.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://duxopenor.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17ed1f40-7feb-554e-acdf-6e926bd30b65","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dynazdom.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dynazdom.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fb9a942-14ff-54ae-a4c9-5d1db727503f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dynazdom.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dynazdom.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02f1d717-fd84-5e04-a9d8-3c294e4f6ee2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dsarapiz9.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsarapiz9.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f44237ce-16c7-593f-bd78-161cf0fdefcc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dsarapiz9.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dsarapiz9.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58585d08-e3fa-5e4e-85ac-a3ab83902574","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dso9asops.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dso9asops.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd15e282-0356-5aca-a771-9acf45535326","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dso9asops.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dso9asops.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--141b2e84-8ed2-5990-b536-4a2203391fd7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dcamso10.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dcamso10.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16becda0-1937-5f01-b26f-f4416a3f08f8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dcamso10.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dcamso10.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--277dbe1b-9c46-59a3-8e51-de9b0bb73447","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dhonexc.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dhonexc.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a103d4-8534-5319-8d9d-5606d2572440","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dhonexc.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dhonexc.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6bdf967-dc4a-56e9-b811-4ba074d97a79","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dsolanosi.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsolanosi.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3f81a8e-045b-5a16-b311-1bc4ea8518d6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dsolanosi.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dsolanosi.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d50a289-4d5b-5ced-930c-acf34094b13a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"412949853a02b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '412949853a02b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d16d8b2-bb1f-5b9e-ae1c-a20da0c3d7e4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://412949853a02b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://412949853a02b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--029f859e-7d43-552a-991a-49b2f59616c9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"us2loadinfo.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'us2loadinfo.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef9245f0-6fad-5629-b7ce-7fd3aab6dde0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://us2loadinfo.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://us2loadinfo.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb9ca41-245f-5f41-a3e8-71e9a2b6ca0e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eclodfast20.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eclodfast20.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34921434-dbc7-5702-b1f4-6d0c6a73480a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eclodfast20.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eclodfast20.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d43bb758-e5f3-5e61-97af-34e70a5e4b2c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"e10a9e5.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e10a9e5.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6380e322-6015-51b8-b925-8d49bce7111e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://e10a9e5.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e10a9e5.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ac6f382-a161-52a3-acea-42672b9f8c2a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"t18delivery.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't18delivery.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46568a5d-06b2-505e-b55d-b0288e755535","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://t18delivery.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t18delivery.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3193511-8a75-5f74-b211-0a833fb88766","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"comdeliv72.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'comdeliv72.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c42f96af-baac-5f31-94d0-5f49fed8683f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://comdeliv72.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://comdeliv72.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db6447cf-290e-5ec0-b827-cb94838f805b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"deon0capload.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'deon0capload.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c2e72a2-10eb-576e-90b4-aca3d5c4efad","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://deon0capload.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://deon0capload.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ff17032-979d-5dba-9e6d-5742c5c40103","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"trackinfo0.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'trackinfo0.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c74e7d64-da2a-5643-b81d-af302e8e5329","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://trackinfo0.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://trackinfo0.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d63b988b-7841-5d14-8fef-715eeac247f7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"sudeliveryn.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sudeliveryn.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cb34bd0-4111-520c-9b3e-e83077782e32","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://sudeliveryn.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sudeliveryn.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6521ff2-172d-5054-9474-b432ef62f532","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eclodfast20.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eclodfast20.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e74d26e-99d4-5ff3-ade6-d9d52aad92b9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eclodfast20.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eclodfast20.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eb68a08-b294-50ff-973c-6a88e02e8c34","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ecxfastpostx.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ecxfastpostx.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--396bedb4-dcd9-5d93-908d-bba30b81d7bd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ecxfastpostx.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ecxfastpostx.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--543db785-2100-570f-8133-65bee188a182","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"comdeliv72.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'comdeliv72.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--696d0f45-83ec-5396-b5d0-0a02ec06f20e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://comdeliv72.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://comdeliv72.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27f36899-0c4d-5e2f-88c6-7c25b5e94bd1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"trackinfo0.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'trackinfo0.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ce716f4-c3f7-53ac-bfee-677dacd0edce","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://trackinfo0.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://trackinfo0.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a79e8c4-d8ff-56ee-98e4-b06588678057","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"us2loadinfo.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'us2loadinfo.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33ae6c5f-c2ee-51bf-88bf-3cceded402f6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://us2loadinfo.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://us2loadinfo.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0382fe2c-f5e3-52fe-b914-4a94adb0ea41","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"sudeliveryn.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sudeliveryn.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61c9a3b8-f504-5260-be5e-75450f2f7c75","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://sudeliveryn.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sudeliveryn.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31067cc1-e446-5dd1-af8b-e15a656a8668","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"micload4.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'micload4.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a649d961-1ea4-54dd-870f-23366abf60d6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://micload4.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://micload4.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--796c42a4-198b-5249-8dcf-513da561cc74","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"t5delivery.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't5delivery.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f6e6795-7f3e-5d07-982d-e3b274732dcd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://t5delivery.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t5delivery.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f596416-d2cc-5441-bf48-a5fd6faca664","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ecxloadon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ecxloadon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47ebd830-e3fa-5ac1-b4e0-cbd7002468f5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ecxloadon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ecxloadon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d0fef8b-78d0-5535-a327-8ea11aba3a3a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"deon0capload.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'deon0capload.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6c86643-5bf3-5872-ae3a-4b0383731c8a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://deon0capload.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://deon0capload.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23743534-f611-5708-80d9-c2bc727dd99a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gate.dnsrd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gate.dnsrd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--734b7f11-0504-549c-a7ed-d746b8f9b548","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gate.dnsrd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gate.dnsrd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9973779a-cd6b-59f0-bc5a-a6680065bdc6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"camcdeliver.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'camcdeliver.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d6fc3ce-9f8e-5061-aaa7-1ac75a68683c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://camcdeliver.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://camcdeliver.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66a798da-87a8-5d9f-b49d-9aaf5cc896b8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"a51a.otzo.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'a51a.otzo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9162c00-cecb-57b2-9208-e6659d9f832b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://a51a.otzo.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://a51a.otzo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59c39227-6333-5b8c-ba3e-03526e8eddc2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"42019239a0s0be.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '42019239a0s0be.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56437815-172c-56d4-96df-6774dcb26784","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://42019239a0s0be.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://42019239a0s0be.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--105ece05-818d-5627-be05-837832bd4cae","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"4c0a910fba9s1235.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4c0a910fba9s1235.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37a3e308-2da5-5e75-a1b3-55b7b0285140","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://4c0a910fba9s1235.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4c0a910fba9s1235.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98c5bfdb-2420-5438-b75e-f032ab5db092","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"419298as9bo2.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '419298as9bo2.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f501abed-5d33-5479-a5ec-acfbd0a94740","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://419298as9bo2.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://419298as9bo2.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31958301-82cc-5b16-9cbb-c1f18e562d1d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"491va9924abef1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '491va9924abef1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e255be7e-7cf1-511e-a728-ddd95e24d06d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://491va9924abef1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://491va9924abef1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68b15520-bc3d-5d23-b619-42d77b769b59","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"48716ba0dea01.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '48716ba0dea01.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1369ca46-1599-5c95-8557-79594dec0a81","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://48716ba0dea01.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://48716ba0dea01.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86e06d48-f310-5f67-a4eb-f0660712d935","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"48d9a9120bae.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '48d9a9120bae.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5a68839-9cbe-5628-97ae-9165018043b4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://48d9a9120bae.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://48d9a9120bae.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f8cc567-ad8b-57b6-86f3-a33823eb78b0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"441929450c2er.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '441929450c2er.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c427a81-65ae-5714-9c28-904c6905ebfa","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://441929450c2er.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://441929450c2er.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--371a099d-c1e0-5ed7-a6b6-4872a8d2dfb9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"4d0q91239eqb5.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4d0q91239eqb5.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--493d2ae4-3dfb-50c7-b26c-eac2089e0762","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://4d0q91239eqb5.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4d0q91239eqb5.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cc041ec-8e41-5b8b-a4fc-1a8e02e488e7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"489817asd9bo.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '489817asd9bo.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f830139a-a624-54ee-9b03-eacbfca412e1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://489817asd9bo.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://489817asd9bo.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71cf091b-68ca-55f6-80f3-437b08c85dad","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"di812fvz.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'di812fvz.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088a7337-73bf-5912-85cf-95a2fb617b1a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://di812fvz.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://di812fvz.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed1680f7-dc86-5571-8a22-4bc8da1bd62a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"p291z0sin04a9.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'p291z0sin04a9.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86189d49-03b4-5972-aa06-b3f83bde50d1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://p291z0sin04a9.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://p291z0sin04a9.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44d73e7d-11be-5801-ad0f-c5de769fe61b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"as912jci1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'as912jci1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fbed31c-0a23-58a3-a246-3ced2e030582","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://as912jci1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://as912jci1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e72a9ad-6f8a-5111-9a1e-955485f4b5ba","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"1928fjcia025.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '1928fjcia025.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--757e2398-019f-511f-add0-ec6a0eca9e10","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://1928fjcia025.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://1928fjcia025.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c6080d1-d04a-5049-80b0-f33689a9f715","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"c0ea0s217.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c0ea0s217.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5d4cc38-a01f-5d9b-be2f-2906ad0ff294","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://c0ea0s217.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://c0ea0s217.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84899a41-f2d2-5638-b183-f7091c89a009","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"00a7c185.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '00a7c185.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9b20961-d731-5b00-a945-f9e61ff9e1d0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://00a7c185.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://00a7c185.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1acca91a-36ca-5204-92f2-43a6ef022373","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"96ad0e.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '96ad0e.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bff8d1a2-c2cf-5da2-9012-22173d0b1401","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://96ad0e.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://96ad0e.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10da5646-6f2e-555c-b8b7-40d4a86fcf28","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"102c928da265b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '102c928da265b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c1c4732-fc8b-5d21-a2cd-12c5180746ff","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://102c928da265b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://102c928da265b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8432931d-8b16-5893-8a2a-e20fd893e55f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://152.32.139.126","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://152.32.139.126']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62187b98-f0da-5407-8a7f-9cf5565456fe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"152.32.139.126","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '152.32.139.126']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fe2d1be-2f79-5c12-b89f-b65307f24b65","created":"2026-05-11T19:48:00.000Z","modified":"2026-05-11T19:48:00.000Z","valid_from":"2026-05-11T19:48:00.000Z","name":"http://5.252.155.27","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://5.252.155.27']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053925235510976551"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--45a24dcf-600e-5032-8da7-74f52e889f63","created":"2026-05-11T19:48:00.000Z","modified":"2026-05-11T19:48:00.000Z","valid_from":"2026-05-11T19:48:00.000Z","name":"5.252.155.27","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '5.252.155.27']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053925235510976551"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--12522f1c-d8d5-51dd-bd9c-f8b9690868fc","created":"2026-05-11T19:48:00.000Z","modified":"2026-05-11T19:48:00.000Z","valid_from":"2026-05-11T19:48:00.000Z","name":"65de4ef064eba4afe141fd4226cd7cd96a1eaf9a6f2e47d3d9ed2aa4e257396e","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '65de4ef064eba4afe141fd4226cd7cd96a1eaf9a6f2e47d3d9ed2aa4e257396e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053925235510976551"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--93b08c5e-605e-5fdd-a2c8-4eda82c63f12","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"l1.topayapp.org:65512","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'l1.topayapp.org:65512']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4072ae1-a467-5deb-9eb4-0e948231c407","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"http://l1.topayapp.org:65512","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://l1.topayapp.org:65512']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bcca5ba-05e3-5464-9abe-3269ef96b6cd","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"ws.z2s.us:2095","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ws.z2s.us:2095']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--df3b509a-d593-5619-8712-6a49bbba74a4","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"http://ws.z2s.us:2095/code","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ws.z2s.us:2095/code']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c98aa18e-7fdf-565f-b367-cdeee987801a","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"30df480a1b77469d441a904bae2c7913ad89f82773437ed8a5166c2425ce7b30","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '30df480a1b77469d441a904bae2c7913ad89f82773437ed8a5166c2425ce7b30']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7427265b-febd-528f-b01a-ddc162255048","created":"2026-05-11T20:00:00.000Z","modified":"2026-05-11T20:00:00.000Z","valid_from":"2026-05-11T20:00:00.000Z","name":"exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053928163021914584"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fded5383-1c16-5986-bcc3-cc1d1bf1f86d","created":"2026-05-11T20:00:00.000Z","modified":"2026-05-11T20:00:00.000Z","valid_from":"2026-05-11T20:00:00.000Z","name":"https://exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053928163021914584"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1520cb7a-781d-5554-9b48-f67e56e2c6ef","created":"2026-05-11T20:14:00.000Z","modified":"2026-05-11T20:14:00.000Z","valid_from":"2026-05-11T20:14:00.000Z","name":"forecast-exact-defined-determined.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'forecast-exact-defined-determined.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053931661214061040"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c6711af-d42d-57b8-83b0-e99d505833ae","created":"2026-05-11T20:14:00.000Z","modified":"2026-05-11T20:14:00.000Z","valid_from":"2026-05-11T20:14:00.000Z","name":"http://forecast-exact-defined-determined.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://forecast-exact-defined-determined.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053931661214061040"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--417097e3-0408-5394-866f-dbd100168e54","created":"2026-05-11T20:14:00.000Z","modified":"2026-05-11T20:14:00.000Z","valid_from":"2026-05-11T20:14:00.000Z","name":"7ccee0bc59cc09e48a3cd99f2cbcd0f478f6503d478042afc660902c1237020a","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7ccee0bc59cc09e48a3cd99f2cbcd0f478f6503d478042afc660902c1237020a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053931661214061040"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--28c9b8bb-d395-51ce-84a0-ff4b6a256950","created":"2026-05-11T20:34:00.000Z","modified":"2026-05-11T20:34:00.000Z","valid_from":"2026-05-11T20:34:00.000Z","name":"http://130.78.217.194:8888","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://130.78.217.194:8888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2053936774099956147"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e883281-a4f8-599b-ba21-1a17230b0a80","created":"2026-05-11T20:40:00.000Z","modified":"2026-05-11T20:40:00.000Z","valid_from":"2026-05-11T20:40:00.000Z","name":"a4e560c61861c4c3d6d614217d93f38fadea8ee6b127ccd85618ff4312582600","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a4e560c61861c4c3d6d614217d93f38fadea8ee6b127ccd85618ff4312582600']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053938334456504462"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4955f368-a47b-57f2-bf9e-18efb73d92b9","created":"2026-05-11T20:45:00.000Z","modified":"2026-05-11T20:45:00.000Z","valid_from":"2026-05-11T20:45:00.000Z","name":"db7680c1636d67085bbd7ea3a15017b4f53bfdd17b0b134c4b3f43ff7f925a6c","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'db7680c1636d67085bbd7ea3a15017b4f53bfdd17b0b134c4b3f43ff7f925a6c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053939515195023656"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a34b8681-4550-5adc-8ff7-fb881ed22606","created":"2026-05-11T22:00:00.000Z","modified":"2026-05-11T22:00:00.000Z","valid_from":"2026-05-11T22:00:00.000Z","name":"3242329-gwdg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '3242329-gwdg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053958372089643141"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a0784cc-d277-5137-b953-63afb4cc90b1","created":"2026-05-11T22:00:00.000Z","modified":"2026-05-11T22:00:00.000Z","valid_from":"2026-05-11T22:00:00.000Z","name":"https://3242329-gwdg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://3242329-gwdg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053958372089643141"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bea10e3-05e7-5762-bdfb-d2c37d12ab88","created":"2026-05-11T22:34:00.000Z","modified":"2026-05-11T22:34:00.000Z","valid_from":"2026-05-11T22:34:00.000Z","name":"bk.muflg.top","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bk.muflg.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053966988641497355"}],"labels":["scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a020271a-d348-5ec9-a582-911ce7d7ccbc","created":"2026-05-11T22:34:00.000Z","modified":"2026-05-11T22:34:00.000Z","valid_from":"2026-05-11T22:34:00.000Z","name":"8.216.44.55","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.216.44.55']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053966988641497355"}],"labels":["scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceb8b863-29dd-5c49-a6a3-37163abe8f49","created":"2026-05-12T00:00:00.000Z","modified":"2026-05-12T00:00:00.000Z","valid_from":"2026-05-12T00:00:00.000Z","name":"wccupdate.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wccupdate.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053988688929898680"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--607cc1ff-af21-5a36-bf03-2c6f0e67a65f","created":"2026-05-12T00:00:00.000Z","modified":"2026-05-12T00:00:00.000Z","valid_from":"2026-05-12T00:00:00.000Z","name":"https://wccupdate.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://wccupdate.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053988688929898680"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14e6a87a-a0c4-5b85-90f4-d28e5fdfad66","created":"2026-05-12T01:44:00.000Z","modified":"2026-05-12T01:44:00.000Z","valid_from":"2026-05-12T01:44:00.000Z","name":"bovurozef.z32.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bovurozef.z32.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054014907600052720"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--02f92006-9546-51d1-bd71-d449f462fd85","created":"2026-05-12T01:44:00.000Z","modified":"2026-05-12T01:44:00.000Z","valid_from":"2026-05-12T01:44:00.000Z","name":"https://bovurozef.z32.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://bovurozef.z32.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054014907600052720"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4392f258-a255-5a02-a14d-b41d04f1ce4c","created":"2026-05-12T02:00:00.000Z","modified":"2026-05-12T02:00:00.000Z","valid_from":"2026-05-12T02:00:00.000Z","name":"kocaelii.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kocaelii.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054018759610823045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cc72eac-3cd6-5a3e-a84c-433029384b57","created":"2026-05-12T02:00:00.000Z","modified":"2026-05-12T02:00:00.000Z","valid_from":"2026-05-12T02:00:00.000Z","name":"https://kocaelii.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kocaelii.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054018759610823045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6a435c-d858-5160-820b-5f8ce3130c62","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"pozeny.shop","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pozeny.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9edce41e-67e8-519e-a43b-064544132990","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"http://pozeny.shop/mart/res/bb.php","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pozeny.shop/mart/res/bb.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2285714f-834a-5bda-bcb9-e2f39e4b1a26","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"731d96ba17bd5714bba1f4f1dbfa0d1487fe2f54ff20bfdc64d4502538c3d587","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '731d96ba17bd5714bba1f4f1dbfa0d1487fe2f54ff20bfdc64d4502538c3d587']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70a7f92e-7ae0-5111-9113-7014820d5bdb","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"0ce1d8a47fc78ac53c0b62bed96b20fa721e3e39115a6248d55100eb01eafff1","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0ce1d8a47fc78ac53c0b62bed96b20fa721e3e39115a6248d55100eb01eafff1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16ac6e0e-2944-52be-9a70-7e24d59e0339","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"https://83.142.209.194/transformers.pyz","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://83.142.209.194/transformers.pyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd6e903e-ec3d-58f9-9b70-51fd792eae44","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"http://83.142.209.194","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://83.142.209.194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--70e399df-2b50-5a98-aee7-afafedf2ad67","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"pgmonitor.py","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pgmonitor.py']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3240659-975f-5100-a917-3b921a9b833b","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"http://pgmonitor.py","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pgmonitor.py']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd5816a0-8e9f-5bc7-a346-a6d0594a9777","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"83.142.209.194","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '83.142.209.194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55cd4ee-c032-5b90-8731-13213ddf9958","created":"2026-05-12T03:36:00.000Z","modified":"2026-05-12T03:36:00.000Z","valid_from":"2026-05-12T03:36:00.000Z","name":"maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054042981045522604"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1d5578a-d84a-5c58-940d-790cc655c850","created":"2026-05-12T03:36:00.000Z","modified":"2026-05-12T03:36:00.000Z","valid_from":"2026-05-12T03:36:00.000Z","name":"https://maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054042981045522604"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb50fac3-b481-5703-b91e-698c224c43d9","created":"2026-05-12T03:36:00.000Z","modified":"2026-05-12T03:36:00.000Z","valid_from":"2026-05-12T03:36:00.000Z","name":"18a3dd7ab5a6cc31bf15d048e519d05b0a569ee5d4595ac6d6abdfdc4d456e94","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '18a3dd7ab5a6cc31bf15d048e519d05b0a569ee5d4595ac6d6abdfdc4d456e94']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054042981045522604"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d35a63-a104-5743-8d43-22ceeffe7baf","created":"2026-05-12T03:42:00.000Z","modified":"2026-05-12T03:42:00.000Z","valid_from":"2026-05-12T03:42:00.000Z","name":"pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054044515875614737"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d530dab0-40b6-5c2d-b1da-2bec2778e968","created":"2026-05-12T03:42:00.000Z","modified":"2026-05-12T03:42:00.000Z","valid_from":"2026-05-12T03:42:00.000Z","name":"https://pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054044515875614737"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a32a41d-2b53-592a-bbcf-40b3b1f7af45","created":"2026-05-12T03:42:00.000Z","modified":"2026-05-12T03:42:00.000Z","valid_from":"2026-05-12T03:42:00.000Z","name":"8a9ec228c1b1cedf445b2751036b4ef50f2a5a68932996bea373d586f3b2d5cf","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a9ec228c1b1cedf445b2751036b4ef50f2a5a68932996bea373d586f3b2d5cf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054044515875614737"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02173ec9-8887-5db0-868b-1c6164a1da7f","created":"2026-05-12T04:00:00.000Z","modified":"2026-05-12T04:00:00.000Z","valid_from":"2026-05-12T04:00:00.000Z","name":"yahoostorage.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'yahoostorage.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054048973661376717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b351ae3f-d9e4-5196-bddf-587cbb5c002a","created":"2026-05-12T04:00:00.000Z","modified":"2026-05-12T04:00:00.000Z","valid_from":"2026-05-12T04:00:00.000Z","name":"https://yahoostorage.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://yahoostorage.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054048973661376717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7035da5c-f6f9-506f-89d8-292de6ca828c","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"dsrzzi.jetgq.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsrzzi.jetgq.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7695193-008b-5d2c-a0a1-5d33f68909be","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"https://dsrzzi.jetgq.cn/jkautixtf/londut/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dsrzzi.jetgq.cn/jkautixtf/londut/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b5e91e1-b504-59fc-9a8d-41f21c788a10","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"http://165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59d1f19c-72a0-54f2-97af-aa6502ed3396","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"ifajiabang.com","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ifajiabang.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb382900-6b26-5cab-b2a1-a328133b2c64","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"https://ifajiabang.com/dca3ei/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ifajiabang.com/dca3ei/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--855b720a-02a6-5c69-b931-af2e2a3f6731","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"http://43.153.186.198","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.153.186.198']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d0c7a81-d27d-5224-80b6-01550df17662","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"43.153.186.198","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.153.186.198']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44da8abc-989e-5b37-9f57-f2cf025a62dd","created":"2026-05-12T04:34:00.000Z","modified":"2026-05-12T04:34:00.000Z","valid_from":"2026-05-12T04:34:00.000Z","name":"rqvzkqb.shbllgs.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rqvzkqb.shbllgs.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054057602485792854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90b621dc-1602-50ed-ac69-2fd26b0a16fe","created":"2026-05-12T04:34:00.000Z","modified":"2026-05-12T04:34:00.000Z","valid_from":"2026-05-12T04:34:00.000Z","name":"https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054057602485792854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca95f41e-5508-54e3-b4b5-38c9e0ad8bfd","created":"2026-05-12T04:39:00.000Z","modified":"2026-05-12T04:39:00.000Z","valid_from":"2026-05-12T04:39:00.000Z","name":"kylesplumbing.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kylesplumbing.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054058738064269677"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b04b2b7b-3891-55e1-8ffe-c3860d869c1e","created":"2026-05-12T04:39:00.000Z","modified":"2026-05-12T04:39:00.000Z","valid_from":"2026-05-12T04:39:00.000Z","name":"http://kylesplumbing.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kylesplumbing.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054058738064269677"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fe77b96-cfa2-560e-8bbc-8c7afea061c4","created":"2026-05-12T05:10:00.000Z","modified":"2026-05-12T05:10:00.000Z","valid_from":"2026-05-12T05:10:00.000Z","name":"https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-50417","description":"IOC reported by @fr0gger_ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-50417']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fr0gger_/status/2054066540551778529"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e3c1f6d-bd4c-5c1b-8b36-7b68d10aef2e","created":"2026-05-12T05:10:00.000Z","modified":"2026-05-12T05:10:00.000Z","valid_from":"2026-05-12T05:10:00.000Z","name":"https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-504171770249968","description":"IOC reported by @fr0gger_ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-504171770249968']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fr0gger_/status/2054066540551778529"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e3a5ff1-fdee-526b-a136-46df78ca9b78","created":"2026-05-12T06:00:00.000Z","modified":"2026-05-12T06:00:00.000Z","valid_from":"2026-05-12T06:00:00.000Z","name":"mail-organized-update.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail-organized-update.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054079185123999945"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b305ed0-85cf-5f13-a286-01dfeb81edfc","created":"2026-05-12T06:00:00.000Z","modified":"2026-05-12T06:00:00.000Z","valid_from":"2026-05-12T06:00:00.000Z","name":"https://mail-organized-update.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mail-organized-update.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054079185123999945"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29cbb620-560d-5e3d-bb56-b32135e9a260","created":"2026-05-12T06:07:00.000Z","modified":"2026-05-12T06:07:00.000Z","valid_from":"2026-05-12T06:07:00.000Z","name":"seur-cdefg.vip","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'seur-cdefg.vip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054081103435084151"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d1e2391-2ffe-5c50-bedc-830475e19789","created":"2026-05-12T06:07:00.000Z","modified":"2026-05-12T06:07:00.000Z","valid_from":"2026-05-12T06:07:00.000Z","name":"http://seur-cdefg.vip","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://seur-cdefg.vip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054081103435084151"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dd04e70-7d1f-59f5-bed1-7d9ce5693a69","created":"2026-05-12T06:21:00.000Z","modified":"2026-05-12T06:21:00.000Z","valid_from":"2026-05-12T06:21:00.000Z","name":"45.227.254.10","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.227.254.10']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054084551589106071"}],"labels":["NetSupport","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19443961-6eef-5fad-853b-46386e428584","created":"2026-05-12T06:21:00.000Z","modified":"2026-05-12T06:21:00.000Z","valid_from":"2026-05-12T06:21:00.000Z","name":"483d16bbbb25c1d0e2c05000ef8a72c3","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '483d16bbbb25c1d0e2c05000ef8a72c3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054084551589106071"}],"labels":["NetSupport","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bde668c-f476-5829-b924-acbba505a667","created":"2026-05-12T06:59:00.000Z","modified":"2026-05-12T06:59:00.000Z","valid_from":"2026-05-12T06:59:00.000Z","name":"147.45.45.238","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.45.45.238']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054093972004311110"}],"labels":["ClickFix","NetSupport","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7110661c-3de4-524e-a96a-305d3b2cacb1","created":"2026-05-12T06:59:00.000Z","modified":"2026-05-12T06:59:00.000Z","valid_from":"2026-05-12T06:59:00.000Z","name":"95.85.246.53","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '95.85.246.53']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054093972004311110"}],"labels":["ClickFix","NetSupport","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3064f28-246e-5784-8e6c-09f1a064f23d","created":"2026-05-12T07:34:00.000Z","modified":"2026-05-12T07:34:00.000Z","valid_from":"2026-05-12T07:34:00.000Z","name":"apartuk.info","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'apartuk.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054102910099759562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f72f201-3d8b-5b2d-ad3a-6b2f45ecf620","created":"2026-05-12T07:34:00.000Z","modified":"2026-05-12T07:34:00.000Z","valid_from":"2026-05-12T07:34:00.000Z","name":"http://www.apartuk.info/hpum/index.php?account=w4naf290","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.apartuk.info/hpum/index.php?account=w4naf290']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054102910099759562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--46ea6e2a-9dd7-5328-a1c6-d78290d4a05a","created":"2026-05-12T07:41:00.000Z","modified":"2026-05-12T07:41:00.000Z","valid_from":"2026-05-12T07:41:00.000Z","name":"fazexmd.com","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fazexmd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2054104731090293040"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b2ae262-aad0-5fec-9bea-6253ad83ca6c","created":"2026-05-12T07:41:00.000Z","modified":"2026-05-12T07:41:00.000Z","valid_from":"2026-05-12T07:41:00.000Z","name":"https://fazexmd.com/wordpress/fark/","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://fazexmd.com/wordpress/fark/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2054104731090293040"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--086521e2-2909-565b-8241-ba6ecb7d2c0f","created":"2026-05-12T08:00:00.000Z","modified":"2026-05-12T08:00:00.000Z","valid_from":"2026-05-12T08:00:00.000Z","name":"eharmonyesec.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eharmonyesec.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054109372112892340"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d608b0a8-c1ba-5418-a2cb-6c2b9a90f197","created":"2026-05-12T08:00:00.000Z","modified":"2026-05-12T08:00:00.000Z","valid_from":"2026-05-12T08:00:00.000Z","name":"https://eharmonyesec.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://eharmonyesec.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054109372112892340"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6fee105-b3d9-5d2a-9934-869c1d1ea67c","created":"2026-05-12T08:14:00.000Z","modified":"2026-05-12T08:14:00.000Z","valid_from":"2026-05-12T08:14:00.000Z","name":"e-stat.online-k1.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.online-k1.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054113088534880473"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03330e5d-5cda-551f-9bf1-316ce3186522","created":"2026-05-12T08:14:00.000Z","modified":"2026-05-12T08:14:00.000Z","valid_from":"2026-05-12T08:14:00.000Z","name":"https://e-stat.online-k1.com/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.online-k1.com/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054113088534880473"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3c1f145-e03c-509c-9a6d-9f0117f4a20d","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"873e628f5d558feb47af978f1c076903","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '873e628f5d558feb47af978f1c076903']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--56a9ad03-f00f-55ab-b546-fe6f72411f33","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"58e5e9a7ef509920b05253aa806422fa","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '58e5e9a7ef509920b05253aa806422fa']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--00147480-81d5-513e-afec-4fd7a04cfcc7","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"bdb677e209c25ee4839bfa3011bf4d96","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'bdb677e209c25ee4839bfa3011bf4d96']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb704689-d4ee-53e4-9b9f-8cecd655d267","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"73f859fe238fdd687736ed2039e1d61d","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '73f859fe238fdd687736ed2039e1d61d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a1f3e15-9065-5674-8270-45db48e3896b","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"9ca07ab3525782b35ec7b4a9c931fe88","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '9ca07ab3525782b35ec7b4a9c931fe88']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--653be9c6-a4c5-5b4d-afb1-37d607d2feb6","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://telegra.ph/tr02-05-02","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://telegra.ph/tr02-05-02']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15dba67d-3342-5928-85e4-c3e49a7b9d9f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://telegra.ph/ki06-05-02","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://telegra.ph/ki06-05-02']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a292478-f187-5e8f-a1ba-94bc92984e49","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"rentry.co","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rentry.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8b83f97-45d5-5ef1-804c-2313d0204248","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://rentry.co/zzk7opdu","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rentry.co/zzk7opdu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a68c1eb-3a0b-5e4c-8a67-f296b3438419","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"rentry.org","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rentry.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8285cb69-8a49-5c16-bf53-5290c2e9edbd","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://rentry.org/wayc2qqz","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rentry.org/wayc2qqz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42a3b89f-bacb-5a14-8600-b3f7b5542c0f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"codeberg.org","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'codeberg.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--430ae76f-f9c8-5770-b78c-c7544dee435f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://codeberg.org/etienne74/guix/raw/branch/master/.gitignore","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://codeberg.org/etienne74/guix/raw/branch/master/.gitignore']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6e7d768-e9fd-5854-9910-e95697c2c1f8","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c79a7bcc-57e1-56a7-85c4-0dfc7892b948","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"http://2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion/t","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion/t']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1306a374-9eca-55e4-84f0-88e20752e6f8","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"parkspringshotel.com","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'parkspringshotel.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be52888c-bc83-5877-b7a7-5e7c1fbc031e","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"http://parkspringshotel.com/m/Lu6aeloo.php","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://parkspringshotel.com/m/Lu6aeloo.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29c12a15-30a2-5de8-9fa7-6a28eac51b29","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"auraguest.lk","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'auraguest.lk']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ee1e5ea-f578-5241-8ce3-6ae6f155422d","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"http://auraguest.lk/m/douV2quu.php","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://auraguest.lk/m/douV2quu.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e50d2283-00fd-5a8b-b3b3-f68957b0325f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"172.96.172.91","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '172.96.172.91']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce053f90-e1b8-5fe3-8ab7-de94e3794c3a","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"209.133.215.178","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '209.133.215.178']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2a426da-cbac-58a0-bcd4-9e5953c5592d","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"c81d723205a25d4cb8bab7b31889623edf5f7e94d63df0d224225b566864cec2","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c81d723205a25d4cb8bab7b31889623edf5f7e94d63df0d224225b566864cec2']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1913680b-582a-5b55-bf08-002cb37418bb","created":"2026-05-12T09:13:00.000Z","modified":"2026-05-12T09:13:00.000Z","valid_from":"2026-05-12T09:13:00.000Z","name":"45387425929d60b59f8d06c1c07f3e399eac8c5289f234bb5a26912509266fd0","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '45387425929d60b59f8d06c1c07f3e399eac8c5289f234bb5a26912509266fd0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054127872173019157"}],"labels":["APT","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1e84bd1-fb18-591a-8652-be0ff58582b7","created":"2026-05-12T09:17:00.000Z","modified":"2026-05-12T09:17:00.000Z","valid_from":"2026-05-12T09:17:00.000Z","name":"zinixpro.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zinixpro.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054128749310841345"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad9b3e20-ceba-5776-b2a1-e1d66bb1aa95","created":"2026-05-12T09:17:00.000Z","modified":"2026-05-12T09:17:00.000Z","valid_from":"2026-05-12T09:17:00.000Z","name":"http://zinixpro.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://zinixpro.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054128749310841345"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--60f88661-90cc-500b-8fc4-1aa20bff95f1","created":"2026-05-12T09:17:00.000Z","modified":"2026-05-12T09:17:00.000Z","valid_from":"2026-05-12T09:17:00.000Z","name":"604b9636828b9fa4e65b3378a8af65c1035ba9905a72a64b760a9541694aae1c","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '604b9636828b9fa4e65b3378a8af65c1035ba9905a72a64b760a9541694aae1c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054128749310841345"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--96088178-a205-5756-8f65-265ab1592f35","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"kollins.co.za","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kollins.co.za']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--db6e3c1f-688c-5c78-9689-af8c62820350","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"http://kollins.co.za/bn.js","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kollins.co.za/bn.js']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb3d793f-2359-5cc4-a672-526bcb3a12db","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"http://kollins.co.za/test.pdf","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kollins.co.za/test.pdf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3000433-64f7-57db-bb31-bbcd347c2b3a","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"5eb9c0577c817e6053ed0658b20e97e0f60077df817f68462ed1f3b243bc0572","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5eb9c0577c817e6053ed0658b20e97e0f60077df817f68462ed1f3b243bc0572']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8a46760-dcc5-522b-89d7-6d791b1c2a65","created":"2026-05-12T09:22:00.000Z","modified":"2026-05-12T09:22:00.000Z","valid_from":"2026-05-12T09:22:00.000Z","name":"0de9cc3daa4dc11053c6b43635355c95b6f51f19f617764efb0e0f2729d01e91","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0de9cc3daa4dc11053c6b43635355c95b6f51f19f617764efb0e0f2729d01e91']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054130180021510571"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fae2ef7a-8ad1-5f1e-b7f4-3b3148f65409","created":"2026-05-12T09:48:00.000Z","modified":"2026-05-12T09:48:00.000Z","valid_from":"2026-05-12T09:48:00.000Z","name":"git-tanstack.com","description":"IOC reported by @SocketSecurity on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'git-tanstack.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SocketSecurity/status/2054048025081737446"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b161b21-c487-5043-aa91-aee92e4dba6a","created":"2026-05-12T09:48:00.000Z","modified":"2026-05-12T09:48:00.000Z","valid_from":"2026-05-12T09:48:00.000Z","name":"http://git-tanstack.com/transformers","description":"IOC reported by @SocketSecurity on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://git-tanstack.com/transformers']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SocketSecurity/status/2054048025081737446"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e8b0b87-034f-5b1f-977d-8c5a3fd61458","created":"2026-05-12T09:52:00.000Z","modified":"2026-05-12T09:52:00.000Z","valid_from":"2026-05-12T09:52:00.000Z","name":"76c19e4e9e4d24ea1e5a7b795ac6301093f59c15bea4a72f0daa5cda312424ae","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '76c19e4e9e4d24ea1e5a7b795ac6301093f59c15bea4a72f0daa5cda312424ae']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054137739826835823"}],"labels":["infostealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c8ea862-a0e4-5cb7-bd36-86f8cef7ff62","created":"2026-05-12T10:00:00.000Z","modified":"2026-05-12T10:00:00.000Z","valid_from":"2026-05-12T10:00:00.000Z","name":"program-shopee22.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'program-shopee22.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054139593369309196"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14d1c490-f0e2-5880-beb7-92dc71fb1344","created":"2026-05-12T10:00:00.000Z","modified":"2026-05-12T10:00:00.000Z","valid_from":"2026-05-12T10:00:00.000Z","name":"https://program-shopee22.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://program-shopee22.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054139593369309196"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b65a164-65b7-5e77-bf77-20b8224943ab","created":"2026-05-12T10:27:00.000Z","modified":"2026-05-12T10:27:00.000Z","valid_from":"2026-05-12T10:27:00.000Z","name":"illuminanceglobal.com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'illuminanceglobal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2054146443292578269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6707477-b12a-57f7-b679-b11618081593","created":"2026-05-12T10:27:00.000Z","modified":"2026-05-12T10:27:00.000Z","valid_from":"2026-05-12T10:27:00.000Z","name":"https://illuminanceglobal.com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://illuminanceglobal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2054146443292578269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04680c81-d96e-5f7e-a5c6-80df09abdc5c","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"njifjuhgh.top","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'njifjuhgh.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2054156236883714493"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b96b2b28-85d6-50de-9dc0-7249cb1fa481","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"http://njifjuhgh.top","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://njifjuhgh.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2054156236883714493"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7503b3e9-48c0-57b3-8f85-a8799c98f7ee","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"7263622822694fc8c2720974c31b5c12b2fdc864ce496ab4f6da57e8c361b59b","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7263622822694fc8c2720974c31b5c12b2fdc864ce496ab4f6da57e8c361b59b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2054156236883714493"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3696b917-78bf-56da-84c0-d41e418bd773","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"http://157.230.222.44/payload.php","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://157.230.222.44/payload.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054156317858693553"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--82cd6737-5b44-5824-be31-4dbea33f1a15","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"157.230.222.44","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '157.230.222.44']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054156317858693553"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--13cc8247-5a5c-58e3-ab9b-3c120329e28c","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"904cee0e70cf6625790b9355993a02d41f88f21ab5ab376f6c08aae649c5fad0","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '904cee0e70cf6625790b9355993a02d41f88f21ab5ab376f6c08aae649c5fad0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054156317858693553"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--953fb54f-7c69-5a87-8fd6-275bdfde64fb","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"s-0s23dlg1u8lo.s3.us-east-2.amazonaws.com","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 's-0s23dlg1u8lo.s3.us-east-2.amazonaws.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3883d82f-a0b8-58e0-9ffd-596de481cae8","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"https://s-0s23dlg1u8lo.s3.us-east-2.amazonaws.com/Mone.msi","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://s-0s23dlg1u8lo.s3.us-east-2.amazonaws.com/Mone.msi']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa5a9c44-35fb-5dd1-a513-0ad6af0f1106","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"7ad98274c5b35f178aa65fc75c1ba675","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '7ad98274c5b35f178aa65fc75c1ba675']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc4c5e8e-2b3e-5c2a-be3f-94aab54e3dde","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"d6c89a7d313aca48f9ac787d27447234","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'd6c89a7d313aca48f9ac787d27447234']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--140cb308-df2a-5c3e-a4d3-08796aeed1cc","created":"2026-05-12T12:00:00.000Z","modified":"2026-05-12T12:00:00.000Z","valid_from":"2026-05-12T12:00:00.000Z","name":"skymailups.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'skymailups.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054169777669566646"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--496ef5b9-5d2e-5fe9-b90e-16d7d62497fa","created":"2026-05-12T12:00:00.000Z","modified":"2026-05-12T12:00:00.000Z","valid_from":"2026-05-12T12:00:00.000Z","name":"https://skymailups.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://skymailups.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054169777669566646"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f18673d3-8632-5c5a-b821-6cecf66ba464","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"macspaceclean.framer.ai","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'macspaceclean.framer.ai']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c178322-ebd0-5364-bfe7-e8c3f7b33c8d","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"http://macspaceclean.framer.ai","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://macspaceclean.framer.ai']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71a7fdc1-f4e2-5794-aa0b-db2c0d3e1126","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"landishivpole.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'landishivpole.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd93b8ea-9cda-5771-b269-a93e46a433b6","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"http://landishivpole.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://landishivpole.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed55121f-6af0-5cff-92cf-fe81f5674f80","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"kw-con.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kw-con.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd4d76a8-ca83-5894-99f0-89008b10aa29","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"http://kw-con.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kw-con.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12ca8fe0-ac2b-52f0-8813-1cce5fc36a3e","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"kw-coc.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kw-coc.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dae99bf2-f331-5943-9de3-c10c092d8f23","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"http://kw-coc.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kw-coc.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c42cf84-6630-5257-bf82-54f8196e8d1d","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"kw-com.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kw-com.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12774546-4262-5fc7-9da4-22212c16e092","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"http://kw-com.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kw-com.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c6e0286-b49f-5163-bbb8-ded24d90f064","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40025a86-7d42-5724-ab37-bfd162becacd","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"http://youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e0fe137-202e-51f4-a0e4-b6cacfbb2cfd","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"http://43.152.26.58","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.152.26.58']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6558c6b5-3029-5912-8387-65b65e695e00","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"43.152.26.58","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.152.26.58']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7415813e-d298-59b7-9709-11cdeefc8a91","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://157.230.222.44","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://157.230.222.44']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7916437a-0e83-5a2c-8a0f-0e90a19c2ae7","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://162.141.111.227","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://162.141.111.227']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--06cfb4fd-e83f-5f9d-8d0a-b295d00a41cd","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://177.54.150.13","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://177.54.150.13']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cb66bf8-6bb7-5cb0-9ec1-18cbe37be397","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.235","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.235']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9228348f-81aa-5dc0-ba49-478b770d3018","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.242","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.242']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--53fdcbbf-4acb-5e65-a3eb-b86f3bbcbafa","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://200.9.155.40","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--91f2c57c-1808-5dee-ae0e-d572d9315c4b","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://37.148.135.245","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://37.148.135.245']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba4f3b00-7971-54a4-b776-cf54d1fd3493","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://162.141.111.227:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://162.141.111.227:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b1d06e6-6f98-56d4-a626-2e1d72d324da","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://177.54.150.13:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://177.54.150.13:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fd75c7f-fb62-547d-9fe4-d8db8add2b26","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.235:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.235:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--32122758-6d79-53d4-af58-1a7e815b64c0","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.242:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.242:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--364d272c-b315-5927-9ec4-cbfb386a9736","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://200.9.155.40:6000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:6000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--184625f6-a234-55de-b2c0-8935b23a07ec","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://200.9.155.40:8080","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:8080']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d71e966-fbd2-55fc-8093-61e7b51b90e2","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"162.141.111.227","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '162.141.111.227']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--869e7c72-7520-53aa-a098-3eca345f0a55","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"177.54.150.13","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '177.54.150.13']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9c57ded-02da-5f33-88eb-0f08e3fd3890","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"181.214.221.235","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '181.214.221.235']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ce37a35-19e4-54a5-8ac1-83629027ff36","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"181.214.221.242","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '181.214.221.242']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--27dc4c8f-9bbd-581b-92bb-9f519288aaf4","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://200.9.155.40:8081","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:8081']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--60586ff7-abea-5f54-af61-a7201b524bea","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://200.9.155.40:8888","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:8888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e1457a6-7855-58ee-8af7-35ef13879d5b","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://37.148.135.245:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://37.148.135.245:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b46935c-4726-5669-9c62-39badaeffa4c","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"cdn-relay.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cdn-relay.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--20fe6d53-36de-513d-a931-4b013f099ab7","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://cdn-relay.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cdn-relay.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0d72c9a-7e97-5439-a6d3-a580ca85c645","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e861e87-b24b-5913-ad62-15a3d54a690c","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffc91074-3a3f-550e-949f-a9082b0c6e96","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c53aeca0-5744-5e7e-9f63-7b75afbdfa8f","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebf93eda-c285-5820-a8d0-52fc0830e54d","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8ffb1d6-6f22-56b8-9a9f-c9f6fff391ec","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7df9c51f-5a7e-5d82-989b-207bc0e15e12","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"c.windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c.windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed5f0600-806c-57d5-8261-7008e4be5822","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://c.windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://c.windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6862914-480b-52f0-8872-09054833ca98","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"c.windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c.windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--44be9286-205b-53ce-ac82-becf58338d45","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://c.windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://c.windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa8c68c7-e024-5272-9c62-d41596095f73","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"uniplus.cktech.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uniplus.cktech.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--95212223-08f8-588e-964c-d732df9985e1","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://uniplus.cktech.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uniplus.cktech.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdcc0546-38a5-5b5a-81f5-9667d44a10b6","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"wss.windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wss.windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--243a7bf3-b02a-5c78-bda2-e8cf6cec3547","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://wss.windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://wss.windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c0ba73e-945e-59e3-baf1-b9ee10997938","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"200.9.155.40","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '200.9.155.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3f01617-115c-53d2-a0ec-4ed9feb5b938","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"37.148.135.245","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '37.148.135.245']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--79169fdc-558a-55bb-ae05-d0f9fc1e9fee","created":"2026-05-12T16:00:00.000Z","modified":"2026-05-12T16:00:00.000Z","valid_from":"2026-05-12T16:00:00.000Z","name":"luuizpaes.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'luuizpaes.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054230163106238717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66d607e2-68cc-5afb-8bd2-10ff6956359f","created":"2026-05-12T16:00:00.000Z","modified":"2026-05-12T16:00:00.000Z","valid_from":"2026-05-12T16:00:00.000Z","name":"http://luuizpaes.github.io/netflix-page/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://luuizpaes.github.io/netflix-page/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054230163106238717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd3697e9-822e-5709-8339-d39c3cd891e3","created":"2026-05-12T18:00:00.000Z","modified":"2026-05-12T18:00:00.000Z","valid_from":"2026-05-12T18:00:00.000Z","name":"kucoinlogiu.gitbook.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kucoinlogiu.gitbook.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054260375277769135"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d87b783-e8da-57bc-89d4-a528b9450a2d","created":"2026-05-12T18:00:00.000Z","modified":"2026-05-12T18:00:00.000Z","valid_from":"2026-05-12T18:00:00.000Z","name":"https://kucoinlogiu.gitbook.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kucoinlogiu.gitbook.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054260375277769135"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f59fbe8-27c1-5b56-89ac-d2f60993ebe3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npchannel25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npchannel25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32b7b7f5-ec06-5527-87b1-14aaf07c142f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npchannel25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npchannel25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f59195-c7ef-5698-a80e-d2d3283bd1eb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc13s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc13s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11cf9a31-d74b-5102-97af-7d4ce3b5075d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc13s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc13s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d751c8f-9717-56e9-afdf-4ff98746cddf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80219a0b-4626-5df9-b62b-d544f879182a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89366d60-6af4-51bb-a57f-65df8ceabb00","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a379124a-08c3-5672-9c6d-45f2b87e4559","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d489c45-d235-5fba-a856-372cb979517b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f262b563-b71f-56d4-ac18-69975b6ce27f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--129cae1a-ec24-5ea6-a6ee-22616bbca7af","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4154065f-d0db-5b6b-89dc-791deede27ef","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81aeca73-d56f-5b5e-ada1-1b2e4e180359","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--493b44d1-4571-51f8-98c1-40fc9d1e90a5","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b58aaba-384e-5e01-9ca3-052a70c6f8fe","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b25637bb-a541-5ae8-85ba-c27ba97c60a9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21852d26-298b-531c-b732-c2515614a241","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e54625d-841b-5c2b-8685-cd10e389c008","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63071d23-6193-5b57-9a59-c76444a1fa8c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74774c43-73ea-5f96-ac7d-2041a50a972f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d52563fb-9114-53c2-96ee-6cfc96ee9c6e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc45s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc45s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e978cb41-3c00-5003-87e8-c9676818f1b3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc45s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc45s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f09d477-643d-51e2-9493-45f7efd19b86","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83f78d6e-47f3-5e60-9d6d-febde04cb3a6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f59562d1-df9f-5e18-a504-1675de424149","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc49s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc49s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a9b5481-39f6-5b92-95a1-08e2fe5ab973","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc49s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc49s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36d6795d-1c8e-5691-9b74-16f72ac3801c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4b6e23e-6d90-5a47-8f8a-8ce315e5d37b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cd7d46b-2641-5843-b127-70da7f2addc2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc87s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc87s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91bfdf1c-dc50-5419-89f9-1b810c76d445","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc87s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc87s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8a156f1-08a6-5a63-baad-d8cd7b75f3d1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbdffd21-9a10-53ce-a877-d154bf4e6734","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f736e38c-7aee-5170-b6cc-8a9b50ce8f9f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23545a31-37d6-5f29-bf9a-0c398863b8c7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01bae8cc-7fcb-5a4c-b488-31046a4c4802","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc30s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc30s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baf22dd0-18be-5ffa-b79f-9d5abebef23a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc30s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc30s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cf72b18-82aa-56f5-b857-33ec4614ef73","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d324f15b-3532-5124-8ba1-fcee519c1589","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47a3e773-072f-5d73-b785-adca547519fa","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc72s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc72s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4990641-5f69-57d8-a391-2e29421b8a25","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc72s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc72s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4742b55-d7cf-5e05-801a-3f315665f5a6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8fc7428-5eb2-5ac0-ad10-98b3178de50f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23dda3ca-ec87-5f5a-a958-c1d2d6473ff6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--318481af-59a5-54c3-b3d3-e7ca2e02ccfc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da762423-c1d6-530d-a31a-0cf2f63b9c0f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nlmsuser5doc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nlmsuser5doc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5d1b97d-05ef-56cd-af46-311060c9de48","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nlmsuser5doc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nlmsuser5doc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50fa2e2a-45ec-5239-a8ec-bb898fcb4473","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59585c26-4b01-52d6-9172-071a12e2801f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffd108ec-928f-5ea6-a63b-45df2b8fb747","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2dcf018-89a3-50f2-a545-94472d6de1c1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b88af220-1602-5c9d-b273-4ff1f72a923c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f2db76d-2b60-51fe-a6dd-478eb165b3ed","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05968b06-c39e-5bec-8daa-583e47127348","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eac63944-6fb1-5a7b-83e2-f2c2d4638f0f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea1a2219-41f0-5a81-ae47-07f2e346a0c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2148d23-7bf2-5506-a830-42723d6ec9f9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6abc8821-0869-588e-89bb-0549b7d8718f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d5d1b99-d8dc-5530-92b7-00e92cd2a332","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--702d31f9-3109-5dc2-9d89-d100ba1a0758","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpolercm10v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpolercm10v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91d43eca-78b1-5723-956c-d1fef76f44c2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpolercm10v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpolercm10v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2bf4245-435e-52e9-83dc-87e952afcf26","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--030e981a-2ab9-574b-bf40-f3bfd7125d4a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6d034fe-caee-5cd4-80bb-2b2b58e8c32e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e625e3-41c3-502c-96a1-7ae12b274422","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1f07625-87fe-56dc-a6d9-cfc9c8029651","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf5b0f55-39d3-53d6-994e-4b0f35187cda","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--593ba1e9-370a-5183-8bf8-7b6bb9450cb8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-53v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-53v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4a3e72c-23a5-5f75-b57a-6f631ef6e2f9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-53v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-53v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82249a36-5fe3-5518-bf09-45b48797267e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18339bc6-7cf3-5fbd-bb3b-89c79b654975","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f058c0d6-4d38-5aa9-9d64-9cbf7ff731e9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37e5c17b-9dcf-5199-b540-be2fb2818679","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a1ce473-988e-510d-af05-48b1a83b0ab9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b0396e0-c035-5cb4-83c8-df7dc6cf9e38","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c69886f9-d281-51cd-9451-d16510261f44","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05ad595e-e3d3-572e-a7da-6c1c8106badd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d93fc6-12fb-5bea-95a6-672723bcb0c7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ae1e3e9-3680-57d7-9ab4-9c492fc2d2be","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3eebbe1d-7e8e-5009-9d36-e3bd9c2d6924","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a87ae92d-79ac-5613-ab7d-4e15305743f5","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e628dc9-3559-5a19-b124-eb8afa458b0f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6f2be5-7e35-5f0c-bcc1-437001ff80ff","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fb0e7a9-db01-5349-92a3-ddfdc5ae8071","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f5907be-3ebd-51a8-8b0a-a33853090edf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76f48c4b-1811-538b-9c52-28ddbe6f841e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10339404-9ec7-548d-ac3a-7bfd02c18101","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b8c415d-8ffa-5ace-a118-42f4e5aa4ee3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02cc4820-48e3-5f5f-9e24-78e2f68579a2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26390f16-75b5-54af-81a9-48a36bcdb0b3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol3s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol3s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fce95b9f-ba37-5c07-97b6-9c33f70c2879","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol3s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol3s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fab18e85-9c24-50d8-9df7-6a8fb9671862","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62a95916-57a2-57b1-9bbc-90e6e417e4b3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62b94d13-3f2c-562b-8661-e3a03a09837f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61394b61-3a8a-54ce-8122-0f0fb4f91daf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea093949-ec87-52cc-ad5b-555e0c5a0a9b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--160e1bee-c21b-5dcf-9c0a-260018d497cf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c57a1766-23a1-536a-90f2-6f84905b03ae","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b731a9fd-291d-5c44-969a-31c46b5736ca","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b759659-61c2-5966-a233-53cca3d8979f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc522080-7cad-5c8b-aa5d-af67b1e685f7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7ac03b5-a28d-5415-844e-6e193ec5d41f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a96995b-dc2e-56a2-92f5-7ec2fde9618e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ae7474e-1f11-5de7-b1d3-613691bb02a3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm34s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm34s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1012f71-6db1-573b-8208-64225bc019d4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm34s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm34s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ee788fa-cb3d-5ea5-931c-e8726207a521","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0a0d990-7172-5573-9d10-380b119f5d4a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa08d415-9ed2-58fa-a192-b5a8450e94c4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf047296-4d9f-518a-9a28-749d3467d7cb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fce42b7-ee86-57e5-95fb-49502e70ce43","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--930a7be9-762f-5322-9f39-88ae22641ca9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--411c6edf-80b0-573d-bfe3-22902f560c92","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--943455a8-29c8-53d4-acb2-279eb91d562d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef3607ab-9138-5e8e-b85f-9ccdf36f9690","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--313119c3-8015-55cc-9e8f-4011fdbfc405","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76ed39fb-3e7a-5e13-9fbc-19b3552e0f9b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d868985-d832-5730-9e18-25c5f74968c4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62136d17-080a-5f17-88be-c1139a50d5ce","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice1s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice1s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f6a41b6-81dc-50fe-ac74-d0203b43ee6c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice1s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice1s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79074b20-2f61-5117-b155-55131ae8fe99","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--822b5ab9-e89e-58d2-a272-b5f72859b3fd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--552c3aff-8cfc-5e75-af5b-bcb2741c2756","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1f3d60e-2862-5209-b999-2603e28bad08","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e3ab8f9-0893-5b38-b01a-10f0259ca34a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a9ed0a6-59ec-5fe5-969c-5fa3d60d10c1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75b26cf7-f9a0-51a7-9f9a-33edfadac4f4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a665277-7d8f-5c84-abd2-03d892d0dc55","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1533031-f223-522a-ad4b-9e8339abab61","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm40s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm40s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4febd434-034d-56eb-a07d-3a72dd4351da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm40s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm40s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39b8b726-0b5f-5b64-8636-6c1ff3f8b3d4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dc9eee2-b274-575d-a6f0-6f135a61099d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--676cb504-1373-50d1-adb9-6f794f9c2df4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3375497-3771-5f68-9eee-287f1096939a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00eddc4a-5e17-5d5f-a5ad-b3ca6b6e9c63","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa914ae5-6d09-572b-bba8-9f6f97f1dd36","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4a17a89-a7a9-5ffc-be65-80dec8b73c42","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5d13af4-3e7c-59bd-a406-f67a1ffce9cc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c62d5fd-b6a7-52dc-9ece-e033290f5c5d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dae15f60-e014-5191-9392-29b29526fecb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a514247-0a57-550c-99c6-143d4a3cedea","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--302b351f-f06a-5fb3-b360-8cb713afc2a8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48422a00-8ddd-5bc8-a595-10b0f09a1ac2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83db3dfe-4765-53e9-8014-43ffc650ba58","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d59b431-79cc-5e29-ab3b-264cac790189","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--218ddd62-7bd9-5d5f-b0e6-3b0fd85b6668","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d288942c-2e20-5fd1-a139-3f338fd4ede9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c95a5065-b0b9-5911-bd66-d1b8f9311a48","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a20cca3-e11e-5f14-9451-3dcaa97b86da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nps.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nps.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56d40863-2d60-55fb-813b-64f611a56fb9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nps.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nps.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--607774cc-4403-5d65-b674-4f5218c2a690","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpaddr70load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpaddr70load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1597ee42-6f02-5d50-bd65-a1ab3f8ce45a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpaddr70load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpaddr70load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6761b366-caa9-54da-a818-498f9c1f359c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b17faca-33ac-5535-92c8-04784255bde7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97f19952-bc0c-5210-8772-349ad707ec86","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38c98e9f-6a96-55b6-a643-c5e4b43a4663","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24e6e687-2cd2-5f8b-9dbf-7e99159bf76b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47cc526d-47e7-51e6-ab8c-f6b2b2ba08ee","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3df8edeb-8720-5fb5-ae0d-ccc29bfe33ce","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48ca976e-07a7-5ea0-9a86-1763d0df186b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30a24f1b-5bf8-52fe-a640-a2a0bbaf29ba","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7ed109e-24ae-5458-996d-9a8fb6da5401","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0caba74-b05d-54d3-9941-cd10cf373989","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9f2d782-3f18-5c81-8897-0fcb275a47bc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eda7e756-6a4f-5992-9289-083167633b1f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nappstatic42svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nappstatic42svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--721f822f-1522-5f77-bc33-216ed4d9f966","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nappstatic42svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nappstatic42svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--268259d4-7fdb-57d7-bddc-4354d3d2a075","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8511ae0e-3b10-57ca-ac56-2a1a7be604a0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fface1e2-ef64-522e-9e5a-8391f18cead5","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efbcba1e-9642-5ae0-befe-366c68656fb6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f0b13c6-df90-57f6-af06-50d6aed7f8e7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cc94d00-ab18-5e7c-b4d5-b294bee25294","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0874dff2-2dee-574b-b43a-1a5709afed8e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34b9d015-bfe5-5b44-a85a-194c2667168a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a30d19ad-16fb-570b-8361-4acda36dec73","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99005c1f-007c-5a24-b75c-80401f309d5c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59bfac5e-8bc5-5336-b18f-daa7fec466eb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--941a6a82-95fb-5a93-ad64-cc950692c3f6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb3b9c8e-fbcb-5ea3-ba47-9d7278843450","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0456c90e-44ff-5fff-a54a-bb0463e6880a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0605cc8b-cb73-5b7f-b6cb-cc686a3e0cde","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d8s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d8s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59579804-7a4b-544b-9024-8f4762ba2efa","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d8s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d8s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb3a6766-5eba-5a19-823c-f5dd5ff30746","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50723e8d-0a16-5a73-8d94-7a114aa541f3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54d82cc4-7554-5c32-9d23-17a70474c628","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-41v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-41v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce68bddb-84ff-5dba-b0ee-108ef42b07da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-41v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-41v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5da77b6-6e5c-5172-a3ae-91b03312546b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf3718b6-cf83-5a6e-9903-f8f399bef7c9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9550a40c-6f20-5506-b574-cd86696bfd8b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf42s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf42s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c8e3afa-635e-5700-8f53-54b43302535b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf42s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf42s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5278466a-8e69-54c9-acc8-780389c29596","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nmethodsrc13v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmethodsrc13v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--244b599e-18ca-5405-86af-7481d4a514b8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nmethodsrc13v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nmethodsrc13v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b11d01d8-6864-5771-960c-ae14e0f08198","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cd5c13f-615d-58f0-a1e1-d2563557b377","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19e5248a-443d-526b-a5dd-701384bfe168","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--863fe6b7-4d0b-5407-8544-315f91381cd1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6deb3db5-6ba5-54a8-ab52-3f1ec8cbb41a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf12s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf12s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfc280ab-67c8-5e53-a172-7819a17e97b1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf12s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf12s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5dcb17b-fc01-5d9e-9cc7-eca0317cb846","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b464450c-9e21-5e06-9e0e-f6ae0c5b82ba","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b326d24-e24a-5c41-9c11-6d59c17f8f2a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"uofficialerc26v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uofficialerc26v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36c2f80d-53d0-5ddc-aa2f-b640d39beac4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://uofficialerc26v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uofficialerc26v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e98f870-474b-538c-816d-a7767c4b33f8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2abf4a6-6954-5576-9321-7c5ed5b6c880","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3e0fae1-ee39-54ca-80bf-1c0720eeb2d6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25ed1167-d442-5aa5-9b55-0fa58779a2c3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76f15e4a-c6b6-52a5-8816-3d5c232355a4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c20ca816-900f-57bc-ab4b-7db012627008","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d389afd3-355b-53fa-9251-5170b9cfb247","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e94e96c9-cfcd-5069-ab45-12118e2032f1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ad53562-f593-55b7-aaee-c515f263df80","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--542d87ad-668a-5cfe-97ab-45f9d0f164ad","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7881dede-d5b8-58d8-acc7-427eeedbbbfd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a3f6b23-1040-5fdb-aba0-a8da2b013639","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e16cd090-b26b-5f73-919c-faafa6717a5f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cc2bb01-ca78-58e4-bc1b-6172040efe00","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--516d4f8a-8e2b-54ab-a00a-966dca73fbac","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4885ed9e-080b-56dd-90b6-b80c8b8e0198","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ec0f1b3-ea79-55a9-be50-821943880e95","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc38s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc38s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02fbce79-c168-5767-bb8e-d2d0b63b30ac","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc38s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc38s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a205342c-c3a7-5c09-a606-050ac0d20687","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4df623c1-e500-50d9-970b-2c5d2c96a189","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3505cce-6a47-5cd4-a0ba-05d753334105","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29563ae7-6bd3-5ec3-80e7-f11ef0a44616","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40bd9ea4-87ae-5e1c-bece-c090944247d7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-94v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-94v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--983995c9-d0c3-5649-8a1d-3ea986c68ef3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-94v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-94v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--771eaacf-d673-5afb-9ce6-7ef5d46812cb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f7ed32b-6ea2-573c-a6f9-773594b1cad8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d4de493-5cc8-540c-9f1d-371d35cff32f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d01c30e-f279-5342-a45b-b7703c8a2fda","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04e302c1-e0a6-588d-bf36-db9ea0534161","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eed5f2f-bb2b-5f80-899b-0255b044b26e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89a5fd1e-22ce-5c12-96a4-95372319f88a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be7ad8ae-1bf6-5b47-87a4-e540f5690acf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65320c96-139f-5a08-927b-3bccdccaf9de","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cfc85b2-d239-541c-8546-c0623b8c987f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85dccb0b-a85b-5a41-9462-98bfaa2eefcd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--367674eb-9a25-5dcf-917f-100ff68cfae4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--133931c2-950c-58e2-a439-c669951fec1a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d36b4e7-2352-575b-ad36-b39d8c302e29","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b2ed046-a857-54ab-9681-371af689077f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f37d4ac9-453d-558c-a9ef-3b3ad3093a84","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b7b681-377c-5ef2-a9cc-60dbc09ad14c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7eb79e4-5b28-50f1-a1dc-2d604b7fbd8e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26275801-123a-56c0-adff-4613598d3083","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol2s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol2s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d13db08-bdb1-5369-9a81-05da77c41dac","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol2s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol2s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6b8c47a-ff6a-5007-bfb2-be50f640b598","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c352616a-1963-5710-91fe-848fa9173a3d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37f7a867-4737-5ba6-b4c4-8828eefc0c63","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9edaff60-2cbf-5e40-bc00-1b375f7e6f96","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af8f2bc5-7f21-5dc8-95dc-98fa874482fe","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cbc149c-a34a-500c-ad02-06d9add09348","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8aa38d7f-5f1a-5329-90ca-a9d2391f9a90","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emebaspol40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emebaspol40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70be92c4-c053-53f4-8ecb-9e0daaa2883c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emebaspol40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emebaspol40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7416ec8-9793-5b64-970e-a3096ba4248b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c18e484d-8fd9-55ea-a452-71a05d6af5af","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77adeeb7-74d8-59b4-b7d9-362b0e8b06c0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--453fa80b-0303-5ae8-8d20-2e10eb629f6f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f9557be-dca5-5af5-86bc-d84f9b46c21d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf3a89bb-d965-5033-9402-1ac4b80e63e9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eeb61c7e-4d16-551d-8aea-63037ca28f33","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3cea6c1-3ff6-5583-9bf7-01cb3e8f9b9d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eb796da-4117-5727-a0b0-d5e4095136f4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5fd29e7-2187-5d78-8029-1134ad003e8d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02abc625-b1a5-5186-8540-a70f14a6be7f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercorps-37load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercorps-37load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea278633-0d96-54c0-a4a4-1508406530d1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercorps-37load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercorps-37load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5b5898f-01f6-58e0-a3ba-191a14d30966","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"erpolicies-11v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'erpolicies-11v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a6b85b5-f790-51a1-9c81-5c8cea260cc1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://erpolicies-11v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://erpolicies-11v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1475723-aec8-5e98-bb59-a7cc3f3c0f04","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol10s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol10s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81eb64b4-b6dc-5999-b7fd-255af4e2656f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol10s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol10s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35199d60-669e-5f73-ac3b-e1d9bebb4934","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-34v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-34v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d0a8eaa-06b6-5118-8055-35975ad5b584","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-34v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-34v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9030dada-ca28-5d10-860b-9a43358adc4b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf41s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf41s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69175c2d-9205-5995-ace2-1a3f4f18d7a2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf41s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf41s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a902e223-47cf-5b62-9ec3-00eb88aa27ba","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25fd61e7-4bf1-5930-8092-70baaef35893","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4d9c043-a106-5ac1-9e54-9da33febea4f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf23s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf23s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35d15f98-8acc-5a27-800b-873c75ec735b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf23s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf23s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84b1a3b8-fd6d-5112-a32a-0f82813b7c10","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a58aae51-e7d1-50aa-aec2-de827e67fcb6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4a8d880-6b0c-5171-89fc-daf1a4dca577","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a02623b-60df-5a8e-8d2c-c24e97d867e6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fa77e47-8626-5161-b502-7acd1a09bc50","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53285c56-c586-5622-861c-43928084ff2a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77edc265-3df3-59b8-910e-9191a32c777d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e071ee6d-4f6b-51b5-8fe2-930d0a4c4a56","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83edd6b0-6cbf-577f-a0d2-7ae754c8788b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nappstatic75svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nappstatic75svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0f6a8ea-5292-5b8d-9fef-fc3a4b666c09","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nappstatic75svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nappstatic75svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3f8e4bc-5eba-52e8-b815-144e21b9bd5b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0bc3a45-ba96-5138-8e09-c5a71692c4d8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f049814-7198-5808-b017-ee76272f86ee","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8607f47-6502-5a79-8d95-bee88101648c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35935b5e-8192-540e-8a03-0e2616f06fc9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm31s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm31s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c07bcf5d-feff-5f2b-8cfb-cf3cabd93702","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm31s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm31s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a8ccf45-907c-5fd9-91d0-0351a83ebda1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48ab835c-7ee3-5649-80de-0e06c306edde","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85f96af2-a66e-50eb-abe3-35ea9cb8e100","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm37s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm37s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--251a2753-05db-5a6d-b9c9-5de6fef6df36","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm37s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm37s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b47cd3e-01f2-58ea-a430-b8b94b885205","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol2s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol2s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb07a415-6e9f-5fc4-82b3-548ccd427003","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol2s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol2s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f3e4e9d-d752-525b-a668-6b9a34d40739","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol18s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol18s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44577281-2c87-5780-84ec-84091f20340c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol18s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol18s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50af0e5e-d301-5f9a-8a95-94297bcf1d9b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol1s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol1s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd9051e7-0ee3-5053-8c20-66fb1760fd26","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol1s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol1s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52f9a043-5384-5a64-80a9-24868f9d7c53","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c501d705-763e-5295-b4a6-0f96f998ef3a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f72f8a8-eb4b-5374-93c0-87d3b072dc84","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol8s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol8s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe0696cc-e6ff-5b64-98aa-48305a833872","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol8s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol8s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2a4fe61-36dd-5c8a-98c2-043aec3e2208","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol8s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol8s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--968ad67e-63f8-5c3e-abdc-6c9504f52d25","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol8s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol8s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d223854-bcbd-5cff-a657-e240ae6eaa62","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf30s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf30s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00bd9705-20fb-5162-bea5-069439b52d10","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf30s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf30s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e52f20c-b7df-551d-b783-ba25e45e1e16","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol6s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol6s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4afaa1e-9d19-517b-b848-88cced38df50","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol6s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol6s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16b83fe8-3df6-5c6b-8c4c-da0967871e31","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf17s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf17s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3120cd7-e51e-5a84-aec5-8fa7bbf36237","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf17s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf17s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--008cb3d5-6532-5da9-972a-0eae79e48035","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol7s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol7s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6c886ca-42a1-5953-8fe3-f3347ca6fe44","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol7s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol7s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2301f4ff-e088-5516-ac33-48d1c7fa083b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol10s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol10s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a731f50e-53d0-53e7-8d35-58e3cc246504","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol10s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol10s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f76e38c1-b4ce-52f5-adc2-5613d77f9f86","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm19s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm19s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4452b2b0-e740-5133-adc7-e2ab7cb5179e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm19s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm19s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d4970bc-0093-5518-81b9-ef1926b4fa14","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm48s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm48s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30954b3d-7e1d-5c4d-8a85-3777af393fca","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm48s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm48s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4575dc6-527a-5ada-baca-62b3b04993c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol5s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol5s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--980c78f3-5ec3-5a22-abb3-72ecb620127a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol5s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol5s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e11c68a3-e944-5803-b4d9-579af4cf164b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm44s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm44s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2179a860-81f1-5ad9-b7f8-a8c4efbf7c79","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm44s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm44s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e8e3973-cf26-5d10-9e61-d0b4140dda8d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"uofficialerc29v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uofficialerc29v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e9c04df-75e4-50dc-83a8-fe74d1ab928f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://uofficialerc29v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uofficialerc29v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb177e9f-4708-5f9d-96d9-e1ef4b1a2747","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol13s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol13s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddc6fd02-ae43-5f09-86a6-a8ce485918da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol13s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol13s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fec3c566-2caf-519c-817b-be397c670ac4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c0be6f4-c048-56ec-80b3-2e33d77c2cae","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b6cf35b-2704-57f9-999c-7b3c5d35740c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bede498d-edc7-5f78-af32-80f98af91b95","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae24d000-a9c2-56c5-8910-1f69154ed830","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a5595df-33f6-5b74-95e0-e29f03d9878f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7b8962f-5576-5b62-8b03-bac1cd699eb0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80954f53-c4dc-50b0-a46d-96313a2ab29c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65522bb1-ec01-5884-9084-a84ddcdbe636","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8badf51-c5c8-5a2e-9f43-be46aaf2d36a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6d8eadf-43b0-5b71-9838-ef4cc34cde04","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69b269a5-c7f1-54fc-b816-61dc35a51c19","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb7fe33e-fc42-5eeb-8d9d-1c38f035b44a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol16s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol16s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d312e1c-26ad-57c4-955b-5c62717ac0c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol16s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol16s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e45e13f9-b428-5ebb-b8cb-49552d917c37","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol20s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol20s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca7e67f8-9d40-59ff-b4fa-16ad59c731bc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol20s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol20s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec3812c3-7150-5fbf-b8a4-a9acde873142","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8442f145-e8bf-51ae-b2ea-6cd0ff90c393","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14a2f9f7-cc63-514a-90df-b18dd7edde94","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60ee2143-6365-5474-aafa-d51946d34448","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daa2b18f-28e4-52e9-85a7-fee88811ca0b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2fdda97-890f-5e59-9b37-9fa0cbffbd49","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e3e8e5f-4c4a-5f13-9a3e-254cbcaf550e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e491c36-f49e-5418-ba08-829dce981e80","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e748aa77-6c7c-5e02-b3e9-a46aea11166e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol4s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol4s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96bff0b-25da-5e7e-8981-222bf354b299","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol4s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol4s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efdbaeb1-952c-5428-ab73-0e5f84cbf213","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d52e039b-f33e-5a21-a3bd-b887c99e1036","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4bd45f7-bce0-5a78-b87e-18fa6fcff329","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f4a27bf-53d5-57c3-9baa-4d3369f77d33","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf926598-5c73-5c0e-95b1-c4b056f3c352","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83b393fa-755e-51b7-9b4a-efd6abe351b4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b39d9984-f356-5ce0-a90f-485d1bd4a76c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e5fc240-ff84-540b-8592-6fcab818c248","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43ba2ca1-a2f7-5752-a746-15025fbf1dd0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpolercm6v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpolercm6v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20dd6773-49fa-5cb8-910f-dfbf106c5477","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpolercm6v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpolercm6v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5432e9f7-7711-582d-aeaa-ecb557a6fde3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nmethodsrc15v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmethodsrc15v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--764c5464-1bd2-585d-85ca-7bcd6a11658a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nmethodsrc15v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nmethodsrc15v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdc90adc-22a1-5fff-93af-da9dedfdac35","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol4s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol4s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--381f83dc-da05-541c-bae2-1516c69fcf1c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol4s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol4s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f740b1a-56b3-52b9-8514-df006847ff42","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpolercm98v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpolercm98v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--315d8e1c-9698-556a-a389-b8b030c11723","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpolercm98v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpolercm98v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--914cf54e-d147-5568-b653-2c0a3758e79e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nps-authdep69svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nps-authdep69svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0c293da-9b29-522a-a77a-213b884a7afd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nps-authdep69svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nps-authdep69svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bf504f0-681b-5e52-95c4-8802974ca0c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-85v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-85v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ee7dba6-a490-5807-a79b-0b3478c86838","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-85v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-85v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2556d9b-bcc1-5f5c-8517-9b2abcfd118a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cf30ead-b96e-5761-8a07-2a2f5a7824bd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d56c44e2-9135-5518-99f8-89726ce50305","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92517221-a047-5a1a-9abe-49f4b60d1b7b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7607356-4c49-53b5-aa77-a77e25edb74d","created":"2026-05-12T20:00:00.000Z","modified":"2026-05-12T20:00:00.000Z","valid_from":"2026-05-12T20:00:00.000Z","name":"finalaccountwarningteam.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'finalaccountwarningteam.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054290551369781289"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ba951a8-78c5-5114-bf57-95673264188f","created":"2026-05-12T20:00:00.000Z","modified":"2026-05-12T20:00:00.000Z","valid_from":"2026-05-12T20:00:00.000Z","name":"https://finalaccountwarningteam.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://finalaccountwarningteam.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054290551369781289"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97d3052e-475d-5602-9f7f-06283de5aa33","created":"2026-05-12T22:00:00.000Z","modified":"2026-05-12T22:00:00.000Z","valid_from":"2026-05-12T22:00:00.000Z","name":"xploreonlineserver.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xploreonlineserver.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054320750966792413"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd02bfc8-bcae-5d90-b24b-6f0c515768e4","created":"2026-05-12T22:00:00.000Z","modified":"2026-05-12T22:00:00.000Z","valid_from":"2026-05-12T22:00:00.000Z","name":"https://xploreonlineserver.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xploreonlineserver.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054320750966792413"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5532f769-d90b-5a40-b84f-37200d91f0ee","created":"2026-05-13T00:00:00.000Z","modified":"2026-05-13T00:00:00.000Z","valid_from":"2026-05-13T00:00:00.000Z","name":"netflix-clone-6.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netflix-clone-6.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054350942758178970"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eeea70e7-12cc-53e7-a1aa-4a9045e651eb","created":"2026-05-13T00:00:00.000Z","modified":"2026-05-13T00:00:00.000Z","valid_from":"2026-05-13T00:00:00.000Z","name":"https://netflix-clone-6.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://netflix-clone-6.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054350942758178970"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f762b2c-847a-5132-b2be-abc0d7347052","created":"2026-05-13T00:22:00.000Z","modified":"2026-05-13T00:22:00.000Z","valid_from":"2026-05-13T00:22:00.000Z","name":"b10a.mobi","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'b10a.mobi']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054356678276264197"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daf90ef3-ed61-55f2-9fd7-94aa413f960e","created":"2026-05-13T00:22:00.000Z","modified":"2026-05-13T00:22:00.000Z","valid_from":"2026-05-13T00:22:00.000Z","name":"https://b10a.mobi/BANTEND","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://b10a.mobi/BANTEND']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054356678276264197"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7328cd5-0842-5aa1-befb-bd14a0ad9b2e","created":"2026-05-13T02:00:00.000Z","modified":"2026-05-13T02:00:00.000Z","valid_from":"2026-05-13T02:00:00.000Z","name":"roblox.gf","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'roblox.gf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054381165683913185"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5309cd3b-98eb-5be5-974f-48f05124ba04","created":"2026-05-13T02:00:00.000Z","modified":"2026-05-13T02:00:00.000Z","valid_from":"2026-05-13T02:00:00.000Z","name":"https://roblox.gf/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=51941004943843141444838697520702","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://roblox.gf/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=51941004943843141444838697520702']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054381165683913185"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c9e70e8-2787-5c86-9bfe-870b1dc8fc02","created":"2026-05-13T02:46:00.000Z","modified":"2026-05-13T02:46:00.000Z","valid_from":"2026-05-13T02:46:00.000Z","name":"leyalobis.z33.web.core.windows.net","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'leyalobis.z33.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054392935853306303"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bf26007-7afe-571a-a2b9-ebdbbef855b6","created":"2026-05-13T02:46:00.000Z","modified":"2026-05-13T02:46:00.000Z","valid_from":"2026-05-13T02:46:00.000Z","name":"https://leyalobis.z33.web.core.windows.net/zucs06iym6hj.html#XwlyjVk2plhmle31","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://leyalobis.z33.web.core.windows.net/zucs06iym6hj.html#XwlyjVk2plhmle31']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054392935853306303"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6d32f89-eb71-5d0a-bc44-4b438c66c7c1","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"qr.paypay.ne.jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qr.paypay.ne.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b25461-10e6-5c3b-912d-a0c6dca6ff85","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_5xY8eHfpfy5DM8nN","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_5xY8eHfpfy5DM8nN']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db3d18ad-d8ed-58a6-9b16-de5e219c2d32","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"45.91.227.43","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.91.227.43']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c88a2879-e7ad-522d-b4c3-4f33eef26ea7","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"3.164.143.89","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '3.164.143.89']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72b64ca2-3bbf-5c06-9944-5c5a1079c798","created":"2026-05-13T03:32:00.000Z","modified":"2026-05-13T03:32:00.000Z","valid_from":"2026-05-13T03:32:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_FuYCLAoaAmaqk9n9","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_FuYCLAoaAmaqk9n9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404330250473931"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c7e1948-401b-5cf3-b470-3205e68d8cf4","created":"2026-05-13T03:32:00.000Z","modified":"2026-05-13T03:32:00.000Z","valid_from":"2026-05-13T03:32:00.000Z","name":"123.180.19.119","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '123.180.19.119']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404330250473931"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a611e54a-2768-5149-8345-af24ce72f587","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"noblemist.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'noblemist.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404688779640949"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0747771-3668-5a0b-9aa0-b2684651a85e","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"https://noblemist.com/notice/information","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://noblemist.com/notice/information']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404688779640949"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed3b386d-d2db-5e82-99ad-f24ddc5d083d","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"e-stat.url-btiyu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.url-btiyu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054404649340506433"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc38a870-5201-5114-8f16-9ae3e8ccb7b8","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"https://e-stat.url-btiyu.com/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.url-btiyu.com/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054404649340506433"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ae5e630-267f-5bc2-9dd8-2d67c83c7f8d","created":"2026-05-13T03:49:00.000Z","modified":"2026-05-13T03:49:00.000Z","valid_from":"2026-05-13T03:49:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_mP0rCB0KG2fij2Zn","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_mP0rCB0KG2fij2Zn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408782344798435"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10b78e32-9fce-5464-85f1-7ae310f94354","created":"2026-05-13T03:49:00.000Z","modified":"2026-05-13T03:49:00.000Z","valid_from":"2026-05-13T03:49:00.000Z","name":"2.59.152.85","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '2.59.152.85']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408782344798435"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16f549fa-f527-5e63-a4fa-42fa589b63fd","created":"2026-05-13T03:50:00.000Z","modified":"2026-05-13T03:50:00.000Z","valid_from":"2026-05-13T03:50:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_vi5lr3RFpYtB9JCq","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_vi5lr3RFpYtB9JCq']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408970035737025"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7203464b-723b-5a51-9fdb-ae72cb982cb8","created":"2026-05-13T03:50:00.000Z","modified":"2026-05-13T03:50:00.000Z","valid_from":"2026-05-13T03:50:00.000Z","name":"113.236.106.100","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '113.236.106.100']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408970035737025"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b3e38f2-9bbd-56b1-a925-8d61c3323c80","created":"2026-05-13T03:59:00.000Z","modified":"2026-05-13T03:59:00.000Z","valid_from":"2026-05-13T03:59:00.000Z","name":"49.87.27.41","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '49.87.27.41']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054411058723569806"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7887d2d-f9ff-552a-8cf7-0d38cbf9c7c1","created":"2026-05-13T04:00:00.000Z","modified":"2026-05-13T04:00:00.000Z","valid_from":"2026-05-13T04:00:00.000Z","name":"pub-3201b0059e074b9486139d100a5af429.r2.dev","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pub-3201b0059e074b9486139d100a5af429.r2.dev']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054411363666059286"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--938c7c0c-faa7-553d-bdc3-1ccdea770462","created":"2026-05-13T04:00:00.000Z","modified":"2026-05-13T04:00:00.000Z","valid_from":"2026-05-13T04:00:00.000Z","name":"http://pub-3201b0059e074b9486139d100a5af429.r2.dev/bv.html","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pub-3201b0059e074b9486139d100a5af429.r2.dev/bv.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054411363666059286"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0025b4f-dbd7-587a-ad09-dd0f26fb2d1c","created":"2026-05-13T04:11:00.000Z","modified":"2026-05-13T04:11:00.000Z","valid_from":"2026-05-13T04:11:00.000Z","name":"nybjhw.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nybjhw.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414268133786028"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6bf0453-d4c6-5e24-8053-2fce7ecc589b","created":"2026-05-13T04:11:00.000Z","modified":"2026-05-13T04:11:00.000Z","valid_from":"2026-05-13T04:11:00.000Z","name":"https://nybjhw.com/?type=verify&key=gzpbbcpsqq","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://nybjhw.com/?type=verify&key=gzpbbcpsqq']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414268133786028"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72dfda7b-78d5-5173-9920-4c2268a6f67e","created":"2026-05-13T04:11:00.000Z","modified":"2026-05-13T04:11:00.000Z","valid_from":"2026-05-13T04:11:00.000Z","name":"34.146.118.97","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.146.118.97']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414268133786028"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fc5873d-7efc-56b9-b095-f7a02b1fc206","created":"2026-05-13T04:12:00.000Z","modified":"2026-05-13T04:12:00.000Z","valid_from":"2026-05-13T04:12:00.000Z","name":"zfhcbj.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zfhcbj.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414428788170809"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71c400fb-6b42-55f7-9434-def9528d3b37","created":"2026-05-13T04:12:00.000Z","modified":"2026-05-13T04:12:00.000Z","valid_from":"2026-05-13T04:12:00.000Z","name":"https://zfhcbj.com/?type=verify&key=olamzfolnj","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://zfhcbj.com/?type=verify&key=olamzfolnj']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414428788170809"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f8d475c-d07c-51d7-a33c-d4be6787a369","created":"2026-05-13T04:33:00.000Z","modified":"2026-05-13T04:33:00.000Z","valid_from":"2026-05-13T04:33:00.000Z","name":"209.87.149.168","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '209.87.149.168']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054419826173751790"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad40e881-d7f0-54d3-97ad-1d61e86c2eb7","created":"2026-05-13T04:33:00.000Z","modified":"2026-05-13T04:33:00.000Z","valid_from":"2026-05-13T04:33:00.000Z","name":"startcompliance.click","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'startcompliance.click']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054419841122279859"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6adfab4-1278-5eb1-8297-54f333ed9454","created":"2026-05-13T04:33:00.000Z","modified":"2026-05-13T04:33:00.000Z","valid_from":"2026-05-13T04:33:00.000Z","name":"https://www.startcompliance.click/kFNQHbvZ8-F1mOj4BOJX-mUNSJP6u-wApaUVu/index.html","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.startcompliance.click/kFNQHbvZ8-F1mOj4BOJX-mUNSJP6u-wApaUVu/index.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054419841122279859"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c396cf03-ccbd-58fe-89f4-1d08fe260c56","created":"2026-05-13T04:45:00.000Z","modified":"2026-05-13T04:45:00.000Z","valid_from":"2026-05-13T04:45:00.000Z","name":"anxingcharge.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'anxingcharge.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422831187014122"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bb6c49b-6083-5d6e-abb4-d564c2d6e783","created":"2026-05-13T04:45:00.000Z","modified":"2026-05-13T04:45:00.000Z","valid_from":"2026-05-13T04:45:00.000Z","name":"https://anxingcharge.com/7HRL93uV34.social","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://anxingcharge.com/7HRL93uV34.social']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422831187014122"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80d187ea-4b27-592a-86b1-d12b7fec4732","created":"2026-05-13T04:45:00.000Z","modified":"2026-05-13T04:45:00.000Z","valid_from":"2026-05-13T04:45:00.000Z","name":"150.136.228.252","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '150.136.228.252']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422831187014122"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--357bd60b-7fb3-5e9e-87e7-df1cd66e6024","created":"2026-05-13T04:46:00.000Z","modified":"2026-05-13T04:46:00.000Z","valid_from":"2026-05-13T04:46:00.000Z","name":"apexkongbai.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'apexkongbai.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422987999494184"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dab82ba-2d36-5051-9b63-ef7d6ddc1eef","created":"2026-05-13T04:46:00.000Z","modified":"2026-05-13T04:46:00.000Z","valid_from":"2026-05-13T04:46:00.000Z","name":"https://apexkongbai.com/NyLTmazo5C.axd","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://apexkongbai.com/NyLTmazo5C.axd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422987999494184"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc8b2508-96cc-5d1a-80ea-5b29f575659a","created":"2026-05-13T04:46:00.000Z","modified":"2026-05-13T04:46:00.000Z","valid_from":"2026-05-13T04:46:00.000Z","name":"150.136.126.82","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '150.136.126.82']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422987999494184"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50e02826-4805-56bf-8f61-2e48a4f05c4c","created":"2026-05-13T04:47:00.000Z","modified":"2026-05-13T04:47:00.000Z","valid_from":"2026-05-13T04:47:00.000Z","name":"annovireverberipump.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'annovireverberipump.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054423168975311327"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--948dde97-2b11-59dc-9696-7687f3617572","created":"2026-05-13T04:47:00.000Z","modified":"2026-05-13T04:47:00.000Z","valid_from":"2026-05-13T04:47:00.000Z","name":"https://annovireverberipump.com/sEv8lV0zeT.niigata-city.jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://annovireverberipump.com/sEv8lV0zeT.niigata-city.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054423168975311327"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df62cf30-d095-52fb-86d9-b7817e7be7da","created":"2026-05-13T04:47:00.000Z","modified":"2026-05-13T04:47:00.000Z","valid_from":"2026-05-13T04:47:00.000Z","name":"192.9.155.132","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '192.9.155.132']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054423168975311327"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d3a55ed-0c3c-52f5-aa18-34153535723e","created":"2026-05-13T04:54:00.000Z","modified":"2026-05-13T04:54:00.000Z","valid_from":"2026-05-13T04:54:00.000Z","name":"jp.5-13paypayz.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jp.5-13paypayz.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054425017224704246"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e54e4a11-7069-5510-8982-e60c818ad2d8","created":"2026-05-13T04:54:00.000Z","modified":"2026-05-13T04:54:00.000Z","valid_from":"2026-05-13T04:54:00.000Z","name":"https://jp.5-13paypayz.com/jp","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jp.5-13paypayz.com/jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054425017224704246"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d99825-c0d9-5eac-95a6-6cd5fa27d04a","created":"2026-05-13T05:01:00.000Z","modified":"2026-05-13T05:01:00.000Z","valid_from":"2026-05-13T05:01:00.000Z","name":"miont.hair","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'miont.hair']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054426734158852466"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a49d53bd-d11e-5f3d-ba40-65bcdd315a0e","created":"2026-05-13T05:01:00.000Z","modified":"2026-05-13T05:01:00.000Z","valid_from":"2026-05-13T05:01:00.000Z","name":"https://miont.hair/?email=vwiyf","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://miont.hair/?email=vwiyf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054426734158852466"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--223ced62-a78f-5aa0-8d15-c88ad5d0fcf4","created":"2026-05-13T05:01:00.000Z","modified":"2026-05-13T05:01:00.000Z","valid_from":"2026-05-13T05:01:00.000Z","name":"52.103.20.94","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '52.103.20.94']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054426734158852466"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--739b4e5d-d209-5089-a866-30a4ec56abba","created":"2026-05-13T05:33:00.000Z","modified":"2026-05-13T05:33:00.000Z","valid_from":"2026-05-13T05:33:00.000Z","name":"annakovaleva.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'annakovaleva.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054434942910931179"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--861f4a7c-1522-544b-a954-ce6a5427889d","created":"2026-05-13T05:33:00.000Z","modified":"2026-05-13T05:33:00.000Z","valid_from":"2026-05-13T05:33:00.000Z","name":"https://annakovaleva.com/?type=verify&key=pfvbhfjzjx","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://annakovaleva.com/?type=verify&key=pfvbhfjzjx']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054434942910931179"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48f037ae-18b9-59a9-a250-db03b478aff5","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"mbapped.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mbapped.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58772937-7d99-5281-8104-ee02e70c0bed","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"https://mbapped.com/?type=verify&key=rsgttabfsb","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mbapped.com/?type=verify&key=rsgttabfsb']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb1cfc4e-941a-5d0f-9eb1-956e1314a300","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"34.146.134.26","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.146.134.26']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7415361b-f45d-51f0-bbbc-8c8adc048ebd","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"101.32.97.203","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '101.32.97.203']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48ac6c13-3a9f-5af2-8abc-20e806074c16","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"https://mbapped.com/captcha/go/44e6a0422861f04489a0488ad82c4771","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mbapped.com/captcha/go/44e6a0422861f04489a0488ad82c4771']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f7a2e88-01e9-58a2-98a8-9ff8d865ef28","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"cvuhvbkeoqdu.top","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cvuhvbkeoqdu.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c972f95-1d7c-5baf-af25-86e8bf02acfe","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"https://cvuhvbkeoqdu.top/jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cvuhvbkeoqdu.top/jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--131efb0b-f1c6-52ef-825a-353eaef38a31","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"43.167.190.152","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.167.190.152']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f5ee7bd-73f7-5912-b2cd-8cbeb415f9c1","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"ccssnk.com","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ccssnk.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e2aef9-22ee-511e-ac3e-e0e5baa45a9c","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"https://ccssnk.com","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ccssnk.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1c2f3c1-ff30-5a4b-bd3b-535c1e4ae2e1","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"http://8.209.198.204","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://8.209.198.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62cf8673-1bc0-539f-810e-c31a03d98d36","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"8.209.198.204","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.209.198.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8afe383c-8aed-58df-a191-fc64347b4a49","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"dsoqqcfd.vjxjrfyu.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsoqqcfd.vjxjrfyu.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f611528b-0dd2-59fb-8354-fc7b944de9c9","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"https://dsoqqcfd.vjxjrfyu.cn/optmer-prefere_html/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dsoqqcfd.vjxjrfyu.cn/optmer-prefere_html/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b5e91e1-b504-59fc-9a8d-41f21c788a10","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"http://165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1fa25f9-8343-5b9e-90ed-c668731f851f","created":"2026-05-13T06:07:00.000Z","modified":"2026-05-13T06:07:00.000Z","valid_from":"2026-05-13T06:07:00.000Z","name":"cqizvybx.bhmsbp.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cqizvybx.bhmsbp.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054443329186828792"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfc6e74f-2b2e-52f0-881f-b1768e3cb28e","created":"2026-05-13T06:07:00.000Z","modified":"2026-05-13T06:07:00.000Z","valid_from":"2026-05-13T06:07:00.000Z","name":"https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054443329186828792"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c01cddb2-e631-51f6-ac8f-58670359a330","created":"2026-05-13T06:15:00.000Z","modified":"2026-05-13T06:15:00.000Z","valid_from":"2026-05-13T06:15:00.000Z","name":"4453b9e985f452365995c399f5292c92764570f03e6a066d7845320dd4ad09a1","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '4453b9e985f452365995c399f5292c92764570f03e6a066d7845320dd4ad09a1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054445326355124566"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--499e1686-82f7-5dd3-96fa-344c1a5d969c","created":"2026-05-13T06:27:00.000Z","modified":"2026-05-13T06:27:00.000Z","valid_from":"2026-05-13T06:27:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_uzRRJAYVKj3BlCER","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_uzRRJAYVKj3BlCER']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054448490722549945"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f51c768e-72c8-5c3e-b54c-6752337c016c","created":"2026-05-13T06:27:00.000Z","modified":"2026-05-13T06:27:00.000Z","valid_from":"2026-05-13T06:27:00.000Z","name":"60.21.12.25","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '60.21.12.25']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054448490722549945"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--637914f5-7718-5d6c-a770-a8b51e861a65","created":"2026-05-13T06:27:00.000Z","modified":"2026-05-13T06:27:00.000Z","valid_from":"2026-05-13T06:27:00.000Z","name":"3.164.143.129","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '3.164.143.129']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054448490722549945"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--297d0bb2-dd5b-53ef-8172-3a7e5b16ee3a","created":"2026-05-13T06:39:00.000Z","modified":"2026-05-13T06:39:00.000Z","valid_from":"2026-05-13T06:39:00.000Z","name":"867514.app","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '867514.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054451554615275819"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ed671c5-d8b1-5272-b034-3fc91e4d05ac","created":"2026-05-13T06:39:00.000Z","modified":"2026-05-13T06:39:00.000Z","valid_from":"2026-05-13T06:39:00.000Z","name":"http://867514.app","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://867514.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054451554615275819"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9692a4cd-bcd4-5797-9d7e-9b2b71b60559","created":"2026-05-13T06:44:00.000Z","modified":"2026-05-13T06:44:00.000Z","valid_from":"2026-05-13T06:44:00.000Z","name":"77.91.97.125","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '77.91.97.125']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054452806208106938"}],"labels":["NetSupport","RAT","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4a41874-022d-5081-a3a8-ab08c586eda6","created":"2026-05-13T06:44:00.000Z","modified":"2026-05-13T06:44:00.000Z","valid_from":"2026-05-13T06:44:00.000Z","name":"91.92.34.113","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '91.92.34.113']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054452806208106938"}],"labels":["NetSupport","RAT","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e9d28e1-fd39-5405-8d92-835b60409858","created":"2026-05-13T06:52:00.000Z","modified":"2026-05-13T06:52:00.000Z","valid_from":"2026-05-13T06:52:00.000Z","name":"e-stat.online-6t.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.online-6t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054454692173033646"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08c93c45-7232-520c-862d-2c5a2260ce29","created":"2026-05-13T06:52:00.000Z","modified":"2026-05-13T06:52:00.000Z","valid_from":"2026-05-13T06:52:00.000Z","name":"https://e-stat.online-6t.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.online-6t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054454692173033646"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10757f5f-bada-5abe-be20-889421188603","created":"2026-05-13T06:52:00.000Z","modified":"2026-05-13T06:52:00.000Z","valid_from":"2026-05-13T06:52:00.000Z","name":"https://e-stat.url-btiyu.com/ktwpraic","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.url-btiyu.com/ktwpraic']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054454692173033646"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ee083bb-b273-514e-bcf9-8f0d3cf916aa","created":"2026-05-13T07:20:00.000Z","modified":"2026-05-13T07:20:00.000Z","valid_from":"2026-05-13T07:20:00.000Z","name":"kifofjfjeio488dzedeuihui48.cfolks.pl","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kifofjfjeio488dzedeuihui48.cfolks.pl']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054461663802183992"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e05de5be-1817-5f5c-b320-3481e63ab1fa","created":"2026-05-13T07:20:00.000Z","modified":"2026-05-13T07:20:00.000Z","valid_from":"2026-05-13T07:20:00.000Z","name":"https://kifofjfjeio488dzedeuihui48.cfolks.pl/at/vx/auth/log","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kifofjfjeio488dzedeuihui48.cfolks.pl/at/vx/auth/log']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054461663802183992"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ab291bf-d8d2-5749-a474-5889e95e2aaf","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"e-stat.cn-web-tg.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.cn-web-tg.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--626226e6-50a7-5cc4-9c82-90763455d7c0","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"https://e-stat.cn-web-tg.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.cn-web-tg.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6fee105-b3d9-5d2a-9934-869c1d1ea67c","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"e-stat.online-k1.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.online-k1.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d266919a-9259-53ef-9e3d-29f667c7be7d","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"https://e-stat.online-k1.com/oo6z309q","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.online-k1.com/oo6z309q']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c748a5d-7c6a-5516-8243-9de1ba6d42fd","created":"2026-05-13T07:27:00.000Z","modified":"2026-05-13T07:27:00.000Z","valid_from":"2026-05-13T07:27:00.000Z","name":"e-stat.zp12362.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.zp12362.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054463514417451467"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8eeedde-4e1b-55ac-a133-2f849c68146e","created":"2026-05-13T07:27:00.000Z","modified":"2026-05-13T07:27:00.000Z","valid_from":"2026-05-13T07:27:00.000Z","name":"https://e-stat.zp12362.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.zp12362.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054463514417451467"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f4e30cc-809e-54b8-ac4c-6a29653156c0","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"http://github.com/ud-7-te","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://github.com/ud-7-te']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054465875894472721"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--045911c9-d7bf-5852-942a-f5a90d093a27","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"http://github.com/d7-te","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://github.com/d7-te']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054465875894472721"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6da7ae95-e59e-553e-b265-6b7a9429987f","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"710cf679e48afe00493042c16a74b482","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '710cf679e48afe00493042c16a74b482']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054465875894472721"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--697c2102-6551-5c91-9dd3-459f4613420a","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"8eeadec70143f1f24635c690e7809285","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '8eeadec70143f1f24635c690e7809285']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2047656208115658987"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd11c81e-9804-5b24-8f92-3745fb0b4b6e","created":"2026-05-13T07:46:00.000Z","modified":"2026-05-13T07:46:00.000Z","valid_from":"2026-05-13T07:46:00.000Z","name":"34.142.2.43","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.142.2.43']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054468394850906419"}],"labels":["C2","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad7d4e38-8106-5c84-8154-54cea7642112","created":"2026-05-13T07:49:00.000Z","modified":"2026-05-13T07:49:00.000Z","valid_from":"2026-05-13T07:49:00.000Z","name":"app-1776040489-oweyma.api-539826ff.workers.dev","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'app-1776040489-oweyma.api-539826ff.workers.dev']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054469006459879433"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--958b0d43-5ccb-5bb2-b15b-8d1f7d518cf3","created":"2026-05-13T07:49:00.000Z","modified":"2026-05-13T07:49:00.000Z","valid_from":"2026-05-13T07:49:00.000Z","name":"http://app-1776040489-oweyma.api-539826ff.workers.dev","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://app-1776040489-oweyma.api-539826ff.workers.dev']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054469006459879433"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0499ca76-dde5-57db-91bf-8e8991dd401a","created":"2026-05-13T07:49:00.000Z","modified":"2026-05-13T07:49:00.000Z","valid_from":"2026-05-13T07:49:00.000Z","name":"8aadebc4fb43fb6cf3d81d5aa35eb479b9f38087d7f5fcd8f5767535dc548859","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8aadebc4fb43fb6cf3d81d5aa35eb479b9f38087d7f5fcd8f5767535dc548859']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054469006459879433"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6baffbac-7606-527f-95b8-a9a44012ca84","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"paypal-signin.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'paypal-signin.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054471755540890014"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cec6faca-9537-53e4-b688-a694213449a3","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"http://www.paypal-signin.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.paypal-signin.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054471755540890014"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb23a78f-21f0-5f04-9679-0fcb2a1af631","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"lanotive.z16.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lanotive.z16.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054471944079339856"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d3bb538-d099-5b12-90b0-afe7033ba2b6","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"https://lanotive.z16.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://lanotive.z16.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054471944079339856"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--702ddb4f-04fb-5f54-9c40-2707cb3841df","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"sixtysixrealestate.com","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sixtysixrealestate.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6ff5ac5-593f-57d1-8bb3-0d6a2d3fef4d","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"https://sixtysixrealestate.com/wp-admin/maint/sophomore/?bfx=AkLwe12026-05-13","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sixtysixrealestate.com/wp-admin/maint/sophomore/?bfx=AkLwe12026-05-13']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a70fb165-e254-5e33-8104-741b8594ff3e","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"https://sixtysixrealestate.com/wp-admin/maint/sophomore/?Eey=cWJvT02026-05-07","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sixtysixrealestate.com/wp-admin/maint/sophomore/?Eey=cWJvT02026-05-07']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d650c19-9349-580d-aa8e-872346fc0e2c","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"a609fb6d4924595384e1459bd5935d295c7e559282d3d9ec31baf9bd59e39525","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a609fb6d4924595384e1459bd5935d295c7e559282d3d9ec31baf9bd59e39525']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d54e9a2-624b-5bb8-9b3f-c66ffd6d1c25","created":"2026-05-13T08:30:00.000Z","modified":"2026-05-13T08:30:00.000Z","valid_from":"2026-05-13T08:30:00.000Z","name":"78.17.41.10","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '78.17.41.10']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054479449056596078"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--34223158-d317-5d2c-9952-d59dd203cb60","created":"2026-05-13T08:53:00.000Z","modified":"2026-05-13T08:53:00.000Z","valid_from":"2026-05-13T08:53:00.000Z","name":"e6c60ca4f996b209bbaf7429182d7ed76acf761bb9c1de63486fcb76635fa58c","description":"IOC reported by @GGtld on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'e6c60ca4f996b209bbaf7429182d7ed76acf761bb9c1de63486fcb76635fa58c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/GGtld/status/2054485228077355101"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3ddf02f-e9a6-5cd6-8e66-d88d40dcd97a","created":"2026-05-13T08:53:00.000Z","modified":"2026-05-13T08:53:00.000Z","valid_from":"2026-05-13T08:53:00.000Z","name":"80.97.160.51","description":"IOC reported by @GGtld on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '80.97.160.51']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/GGtld/status/2054485214399754371"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c66da211-6d51-5193-980e-f8f9a3230506","created":"2026-05-13T09:18:00.000Z","modified":"2026-05-13T09:18:00.000Z","valid_from":"2026-05-13T09:18:00.000Z","name":"0e78b6737119a3141e466464ee2748eb84a61750958d0cb5824febbdadd875be","description":"IOC reported by @v12sec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0e78b6737119a3141e466464ee2748eb84a61750958d0cb5824febbdadd875be']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/v12sec/status/2053221862608445645"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c5274f6-a41c-5ad8-8633-a728c257b75b","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"http://103.187.4.61","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://103.187.4.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aacd632c-b06c-5cb4-833f-fa0589203901","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"103.187.4.61","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '103.187.4.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8120dd55-13bc-59a1-81cc-28e96dce1801","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"0e57107c60632e756ab1684777842170","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '0e57107c60632e756ab1684777842170']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0593a08-4c05-5a05-9b10-44584c27b7a3","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"f4b35de8b2442f2f20bcaa6250e8aae3","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'f4b35de8b2442f2f20bcaa6250e8aae3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d08faf9-7659-5e8c-92f1-fdb1181a7d5d","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"97e5b28bd19ff01aaa24cb7b1bae135c","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '97e5b28bd19ff01aaa24cb7b1bae135c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb25473e-fe0f-581a-9c7f-cf97790e1b9f","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"xwjyzxf-jp77.icu","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xwjyzxf-jp77.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0fd7b21-6fb9-5799-9460-9393e984554e","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"http://xwjyzxf-jp77.icu","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xwjyzxf-jp77.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a8c4220-37d8-5fe2-861f-fad340ef010f","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"4926590d8ced37f434d47d4a27ad1444","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '4926590d8ced37f434d47d4a27ad1444']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f60ebad-45f1-5cd4-82db-064b582be537","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"0a1fd68a1fbab226ed926977f89df6621713aac36da7ee076a30db99d8be4c5c","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0a1fd68a1fbab226ed926977f89df6621713aac36da7ee076a30db99d8be4c5c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a7bd414-1b3a-5ad6-b367-2f1b7785bf46","created":"2026-05-13T09:56:00.000Z","modified":"2026-05-13T09:56:00.000Z","valid_from":"2026-05-13T09:56:00.000Z","name":"pexaro.vu","description":"IOC reported by @Priv8Shops on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pexaro.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Priv8Shops/status/2054500930129907753"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af2bb779-aa2b-57e6-9f5e-110d2e06724f","created":"2026-05-13T09:56:00.000Z","modified":"2026-05-13T09:56:00.000Z","valid_from":"2026-05-13T09:56:00.000Z","name":"https://pexaro.vu/nja/index.html","description":"IOC reported by @Priv8Shops on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://pexaro.vu/nja/index.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Priv8Shops/status/2054500930129907753"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--655f0ada-0a2e-5a6b-bac3-4fea38241330","created":"2026-05-13T10:00:00.000Z","modified":"2026-05-13T10:00:00.000Z","valid_from":"2026-05-13T10:00:00.000Z","name":"upohold-logiinus.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'upohold-logiinus.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054501957050491130"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49e2daa3-2475-58b9-810a-050ecbb896fe","created":"2026-05-13T10:00:00.000Z","modified":"2026-05-13T10:00:00.000Z","valid_from":"2026-05-13T10:00:00.000Z","name":"https://upohold-logiinus.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://upohold-logiinus.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054501957050491130"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef3425ed-e8d5-59db-9f37-36cce4da0ddd","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"http://151.80.169.178","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://151.80.169.178']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb50a4ff-0d71-584f-9042-97605a4a002f","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"151.80.169.178","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '151.80.169.178']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--82ce4f6d-5239-5ba2-ba78-93f364634aa5","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"e2d282627a232e4f6231c8ff0108a08b4e40c14104199d78a9e7e08ff377f248","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'e2d282627a232e4f6231c8ff0108a08b4e40c14104199d78a9e7e08ff377f248']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0471370e-5ec9-5544-8b80-b8e41107dabd","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"098be7f80aa90d2fcdd2996d8d4126f7a7fb759d429cc9f6327c9bdd48afc1b8","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '098be7f80aa90d2fcdd2996d8d4126f7a7fb759d429cc9f6327c9bdd48afc1b8']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fcad5ab-b2f4-5dea-a7e9-5306722d15a4","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0a691bb-92a8-5194-8a2c-8243f386b230","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"http://www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a99a7089-ef2d-5de2-b778-9f42bc849d9d","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"http://8.218.252.45","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://8.218.252.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--54d84a8a-b2b5-5812-ab76-badef0695c5a","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"8.218.252.45","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.218.252.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--32effdbf-c1dc-5c4e-aeca-2e1ae9b42c00","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"d5b10a827a2811d516cf6e0d601eb9d7354d37b7d7e5791aceb0227482f3227a","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd5b10a827a2811d516cf6e0d601eb9d7354d37b7d7e5791aceb0227482f3227a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6cf55e3-4ebc-53f5-8fb3-ae1e361491f3","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"velmorixan67.org","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'velmorixan67.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fc0912f-601b-5bf1-87d7-44c0d085d1f0","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"http://velmorixan67.org","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://velmorixan67.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc26d257-abd3-557d-a548-58b4ade08327","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"expressupdatedata.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'expressupdatedata.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ff28b6d-c56f-579f-9f04-f4fb9ada35f1","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"http://expressupdatedata.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://expressupdatedata.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--78d4b2cc-9cf9-5ab9-bc4c-a2ab509c88af","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"10ac291868de15712fb32100f25f5c0331fba5e70ef0347b953474d9b153bb81","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '10ac291868de15712fb32100f25f5c0331fba5e70ef0347b953474d9b153bb81']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c11eab2-dfb6-5928-bdd7-4574fdb2d784","created":"2026-05-13T11:06:00.000Z","modified":"2026-05-13T11:06:00.000Z","valid_from":"2026-05-13T11:06:00.000Z","name":"ifo-jupyter.natter.icu","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ifo-jupyter.natter.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054518692298273011"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c36789c-4bb1-55ab-a9c9-162ea07ef7a5","created":"2026-05-13T11:06:00.000Z","modified":"2026-05-13T11:06:00.000Z","valid_from":"2026-05-13T11:06:00.000Z","name":"https://ifo-jupyter.natter.icu/wp-content/plugins/easy-product-bundle","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ifo-jupyter.natter.icu/wp-content/plugins/easy-product-bundle']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054518692298273011"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a18529c5-533f-5405-90ce-0f64fd926203","created":"2026-05-13T11:06:00.000Z","modified":"2026-05-13T11:06:00.000Z","valid_from":"2026-05-13T11:06:00.000Z","name":"ce1822f4150fb641b445c3b85f990ecbe68bf30ee3ee2cc8e5e92f45d8ae3937","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ce1822f4150fb641b445c3b85f990ecbe68bf30ee3ee2cc8e5e92f45d8ae3937']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054518692298273011"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4eb2a9e-7a95-5a79-beb0-fc4086d03502","created":"2026-05-13T11:08:00.000Z","modified":"2026-05-13T11:08:00.000Z","valid_from":"2026-05-13T11:08:00.000Z","name":"adaptor-individual-signing-statute.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'adaptor-individual-signing-statute.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054519199704236491"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a87376e8-b1dd-51fa-a65b-e34a6f485031","created":"2026-05-13T11:08:00.000Z","modified":"2026-05-13T11:08:00.000Z","valid_from":"2026-05-13T11:08:00.000Z","name":"https://adaptor-individual-signing-statute.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://adaptor-individual-signing-statute.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054519199704236491"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b11c03-0475-526f-b2a9-442c839680ba","created":"2026-05-13T11:21:00.000Z","modified":"2026-05-13T11:21:00.000Z","valid_from":"2026-05-13T11:21:00.000Z","name":"kanpyasunfursathemnbashur3498023209.click","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kanpyasunfursathemnbashur3498023209.click']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054522495672201542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8a56bb0-f399-5ad2-aef3-097e04c2ddfe","created":"2026-05-13T11:21:00.000Z","modified":"2026-05-13T11:21:00.000Z","valid_from":"2026-05-13T11:21:00.000Z","name":"https://kanpyasunfursathemnbashur3498023209.click","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kanpyasunfursathemnbashur3498023209.click']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054522495672201542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--304fab1d-065d-559d-af64-2a14b5d210e3","created":"2026-05-13T11:42:00.000Z","modified":"2026-05-13T11:42:00.000Z","valid_from":"2026-05-13T11:42:00.000Z","name":"freecoinairdrop-two.vercel.app","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'freecoinairdrop-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054527619958296586"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d16ffe0-7d24-5656-be21-33d9456f089d","created":"2026-05-13T11:42:00.000Z","modified":"2026-05-13T11:42:00.000Z","valid_from":"2026-05-13T11:42:00.000Z","name":"https://freecoinairdrop-two.vercel.app","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://freecoinairdrop-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054527619958296586"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c93c9cf-1e37-5368-83b0-3db878286c55","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"intechcloudhosting.com","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'intechcloudhosting.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c7dd22-4f44-5dba-ba03-2c27febe76b0","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"https://intechcloudhosting.com/b/index.php","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://intechcloudhosting.com/b/index.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fbcc082-482f-5457-86cb-c77cac4997cf","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"whinypaluza.com","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'whinypaluza.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76d8ae05-39de-5c87-8fea-e83d2663b7b6","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"https://whinypaluza.com/wp-content/upgrade/ceri/index.html","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://whinypaluza.com/wp-content/upgrade/ceri/index.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--900ee29a-40e9-5af4-926a-5e79e2a556b0","created":"2026-05-13T12:00:00.000Z","modified":"2026-05-13T12:00:00.000Z","valid_from":"2026-05-13T12:00:00.000Z","name":"xn--2n1b810a1er8ivvcx0yyhc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xn--2n1b810a1er8ivvcx0yyhc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054532153484955991"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dcc524c-d128-5a94-80df-605b8222957f","created":"2026-05-13T12:00:00.000Z","modified":"2026-05-13T12:00:00.000Z","valid_from":"2026-05-13T12:00:00.000Z","name":"https://xn--2n1b810a1er8ivvcx0yyhc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xn--2n1b810a1er8ivvcx0yyhc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054532153484955991"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b6c7b03-a711-5e0c-a492-55c85c07e973","created":"2026-05-13T12:23:00.000Z","modified":"2026-05-13T12:23:00.000Z","valid_from":"2026-05-13T12:23:00.000Z","name":"c29t1jqg9qfc16yycas6eq0jyhz.live","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c29t1jqg9qfc16yycas6eq0jyhz.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054538128493555815"}],"labels":["malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b2aa54f-722c-5793-a98f-e75dddc09252","created":"2026-05-13T12:23:00.000Z","modified":"2026-05-13T12:23:00.000Z","valid_from":"2026-05-13T12:23:00.000Z","name":"https://c29t1jqg9qfc16yycas6eq0jyhz.live","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://c29t1jqg9qfc16yycas6eq0jyhz.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054538128493555815"}],"labels":["malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34dc11b9-5120-5e20-9c89-38bc32dd32fb","created":"2026-05-13T12:23:00.000Z","modified":"2026-05-13T12:23:00.000Z","valid_from":"2026-05-13T12:23:00.000Z","name":"9a84358abd65a12ccba385d3ebd4ec6a89c720b29abf31732c479503709d5059","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '9a84358abd65a12ccba385d3ebd4ec6a89c720b29abf31732c479503709d5059']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054538128493555815"}],"labels":["malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58999904-efa0-5fd5-96f9-5370386dc734","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"m365.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'm365.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fdf8a75-5a86-5cbb-a8bc-910053b23503","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"http://m365.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://m365.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd24262e-8b12-56ba-bd29-67d5e268c694","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"secure.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'secure.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fdf3b1d-ee0f-59ba-826e-49f75ff10149","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"http://secure.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://secure.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b74b59e4-2bf4-5882-b22f-0afc7d7948f4","created":"2026-05-13T13:18:00.000Z","modified":"2026-05-13T13:18:00.000Z","valid_from":"2026-05-13T13:18:00.000Z","name":"jp-postbank.nmbcv.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jp-postbank.nmbcv.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054551753295835210"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9896e702-53dc-553e-abaf-4360ab01fe13","created":"2026-05-13T13:18:00.000Z","modified":"2026-05-13T13:18:00.000Z","valid_from":"2026-05-13T13:18:00.000Z","name":"https://jp-postbank.nmbcv.com/eFtDCclH","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jp-postbank.nmbcv.com/eFtDCclH']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054551753295835210"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fc6dd45-2a03-5166-b1b2-6c5b30aa7e3f","created":"2026-05-13T13:18:00.000Z","modified":"2026-05-13T13:18:00.000Z","valid_from":"2026-05-13T13:18:00.000Z","name":"195.86.16.149","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '195.86.16.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054551753295835210"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffa8afd3-665b-59a8-ad59-0f97f6898c70","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"https://xwjyzxf-jp77.icu","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xwjyzxf-jp77.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553783603220488"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6592152-daea-5276-9c62-38a538aa4d34","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"http://38.76.199.112/Check.zip","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://38.76.199.112/Check.zip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553788883849289"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de36f97-dc30-5a0b-89cb-f35914db182f","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"38.76.199.112","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '38.76.199.112']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553788883849289"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5e4215-dbfe-5c51-890e-57f1346d966f","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"8b7ca9f2836e43a5655dafcf5cb8e580e091b341db66d0896a816c96a52aa60c","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8b7ca9f2836e43a5655dafcf5cb8e580e091b341db66d0896a816c96a52aa60c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553788883849289"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a5c6400-70ef-5524-a35f-0466a25efb54","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"http://38.76.199.112:28888","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://38.76.199.112:28888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553790507073915"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3385cb88-5f42-5957-b4d0-098bd42de60a","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"c0c21b0cacc2aed672764d322e2e15ea6dd95dfd06126d0266354a1ecbb1f1b3","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c0c21b0cacc2aed672764d322e2e15ea6dd95dfd06126d0266354a1ecbb1f1b3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553790507073915"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--08988aac-ecab-5ac0-a1c3-2b486621c25b","created":"2026-05-13T14:00:00.000Z","modified":"2026-05-13T14:00:00.000Z","valid_from":"2026-05-13T14:00:00.000Z","name":"secure-univ-antilles-fr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'secure-univ-antilles-fr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054562352188530786"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b851917b-96ce-51ea-bdbc-578831c60192","created":"2026-05-13T14:00:00.000Z","modified":"2026-05-13T14:00:00.000Z","valid_from":"2026-05-13T14:00:00.000Z","name":"https://secure-univ-antilles-fr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://secure-univ-antilles-fr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054562352188530786"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2345009-9ab3-5b21-a491-7d4686da2816","created":"2026-05-13T14:09:00.000Z","modified":"2026-05-13T14:09:00.000Z","valid_from":"2026-05-13T14:09:00.000Z","name":"162.214.153.83","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '162.214.153.83']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2054564585428935062"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d305968f-c546-5d31-a44e-f15d1252f6ef","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"dinewithuss.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dinewithuss.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a00b8ecc-3e72-5b92-9719-4908a2d5c862","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"http://dinewithuss.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dinewithuss.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a57ebd1-5da1-539f-b0df-1b7c0051d87c","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"http://130.12.180.40","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://130.12.180.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b67e185e-944c-5fd4-8074-ccc40ecdf713","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"invltecirclle.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invltecirclle.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--926820b5-c506-5c04-afe4-8ad07cf2b16b","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"http://invltecirclle.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invltecirclle.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f697d05d-6886-5d3e-bf54-1a5a2c0afaf6","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"130.12.180.40","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '130.12.180.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--523710e9-5b70-565c-942e-f1a66d45436e","created":"2026-05-13T15:22:00.000Z","modified":"2026-05-13T15:22:00.000Z","valid_from":"2026-05-13T15:22:00.000Z","name":"firstcitizensecure.vercel.app","description":"IOC reported by @Alopsis on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'firstcitizensecure.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Alopsis/status/2054583063275802835"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e39ea420-1110-5f2c-ac40-c78ae9eb73ea","created":"2026-05-13T15:22:00.000Z","modified":"2026-05-13T15:22:00.000Z","valid_from":"2026-05-13T15:22:00.000Z","name":"https://firstcitizensecure.vercel.app","description":"IOC reported by @Alopsis on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://firstcitizensecure.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Alopsis/status/2054583063275802835"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12417d75-2781-5e4b-a157-36507e28eed5","created":"2026-05-13T15:29:00.000Z","modified":"2026-05-13T15:29:00.000Z","valid_from":"2026-05-13T15:29:00.000Z","name":"driect-jabnnka-c.com","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'driect-jabnnka-c.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054584727152345109"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a67b4ca5-4062-5243-895b-f87a5881e9e4","created":"2026-05-13T15:29:00.000Z","modified":"2026-05-13T15:29:00.000Z","valid_from":"2026-05-13T15:29:00.000Z","name":"https://driect-jabnnka-c.com","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://driect-jabnnka-c.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054584727152345109"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--487d0c69-b737-5b39-913c-147af59d1070","created":"2026-05-13T15:29:00.000Z","modified":"2026-05-13T15:29:00.000Z","valid_from":"2026-05-13T15:29:00.000Z","name":"137.220.152.149","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '137.220.152.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054584727152345109"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaf205d3-8184-5628-aca7-e93250bc6dc0","created":"2026-05-13T15:34:00.000Z","modified":"2026-05-13T15:34:00.000Z","valid_from":"2026-05-13T15:34:00.000Z","name":"97361a91ba80981ca549ed19b2e2b9250fed6231027cd15418578b3db76b02ab","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '97361a91ba80981ca549ed19b2e2b9250fed6231027cd15418578b3db76b02ab']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054586126854181101"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e5bf101-8ca6-5fc2-afc2-8ddffb316ec0","created":"2026-05-13T16:00:00.000Z","modified":"2026-05-13T16:00:00.000Z","valid_from":"2026-05-13T16:00:00.000Z","name":"postnbgf.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'postnbgf.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054592548891508962"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caed4fd6-0764-577e-9e8e-42f4fba22a0b","created":"2026-05-13T16:00:00.000Z","modified":"2026-05-13T16:00:00.000Z","valid_from":"2026-05-13T16:00:00.000Z","name":"https://postnbgf.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://postnbgf.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054592548891508962"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96f6fd1-a07d-50d0-a760-f9291277ab94","created":"2026-05-13T16:20:00.000Z","modified":"2026-05-13T16:20:00.000Z","valid_from":"2026-05-13T16:20:00.000Z","name":"mem.calcuttaswimmingclub.com","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mem.calcuttaswimmingclub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054597569158750658"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15352cd-2491-5d50-9ef1-de2c316bfc07","created":"2026-05-13T16:20:00.000Z","modified":"2026-05-13T16:20:00.000Z","valid_from":"2026-05-13T16:20:00.000Z","name":"https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054597569158750658"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b69744db-f94f-5ddf-a8ba-ca5b91a0c08b","created":"2026-05-13T18:00:00.000Z","modified":"2026-05-13T18:00:00.000Z","valid_from":"2026-05-13T18:00:00.000Z","name":"btnnthdtrhbhtrhcfgtrhchtr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btnnthdtrhbhtrhcfgtrhchtr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054622744579318032"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ad6368-0bf8-55b1-8a48-5a230aace73c","created":"2026-05-13T18:00:00.000Z","modified":"2026-05-13T18:00:00.000Z","valid_from":"2026-05-13T18:00:00.000Z","name":"https://btnnthdtrhbhtrhcfgtrhchtr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://btnnthdtrhbhtrhcfgtrhchtr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054622744579318032"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b395b8a9-c8f1-572c-85df-597008bbee9f","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"docinfo.ndocline-st51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndocline-st51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08e68c70-6c4a-53c1-981e-55e8c9179ea4","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://docinfo.ndocline-st51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndocline-st51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aca2c5e-08f5-5328-b13d-0e0c35cf4fff","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9001fd97-9e46-542b-86d9-fca24be63abe","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5052c67-d683-5992-a2af-1eac62cb755a","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"uhmymkd.reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uhmymkd.reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cfa0bcb-f28e-5ac7-9117-dfb82c630d61","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://uhmymkd.reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uhmymkd.reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05265a15-e5a4-5691-8bec-c1e6eab69a86","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13bdfc0c-e6ae-5597-bd12-5cb2088ddfea","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fb020ec-eb14-5e41-9004-cd29bb19df70","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"qxnhdalc.naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qxnhdalc.naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d0fa27b-b79f-57cd-8e0f-198dbeeecb22","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://qxnhdalc.naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qxnhdalc.naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f11a28e-35b2-58d4-8f42-3fc2b2da5e6a","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02cf609a-92d6-564f-aaf2-d7e9a1376975","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39d42c90-9af1-5fad-b153-3815aad19ccc","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"mhjwsf.reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mhjwsf.reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf0c6b3b-e78b-55b4-8ee4-7945d79f44e0","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://mhjwsf.reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mhjwsf.reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46d62100-5bc6-5a25-8ef4-45b22f17ddd3","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"nid-navertca.servehalflife.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-navertca.servehalflife.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f19c293a-6de2-5e6c-853f-2cda8ed4149e","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://nid-navertca.servehalflife.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-navertca.servehalflife.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb6d949-690e-570f-9326-f47d4e3ea1f8","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c41e64fd-bb60-5e1c-a8ea-f62b098b645e","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50535afb-442a-5444-8033-4bb69b2fc3b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2568cd95-b7d1-58a3-8333-b77ca29f2716","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a64e274-6798-570f-b694-266757288958","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e8f065a-4329-5d8e-b905-7de6d4b1b18d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ca1372a-adc1-519b-8267-292de844c34d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a357228a-157d-506a-8a4b-016e6237f9b6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ff5b0a3-9860-55a6-abbf-533829115562","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f43b583b-e1ea-585c-af60-42e886208153","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e5714ce-8df0-5112-aab8-42a8669d4120","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d1221d-eacb-569c-ab58-d0533b4e2ccb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be54bddf-569f-581d-9a23-b0198fe6f4a7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ba03bfb-0807-5661-8e53-6944ad70f5ed","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97f2ed93-7ad2-508f-879d-07bb74dfb256","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1684fcd1-e145-501b-a5b1-76a70f8f8849","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45ea2ca0-28ef-5079-bd06-f53e1086b5be","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3d6fdc0-478e-5eec-803d-844e6949737f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fedf4c82-0587-5cd5-a731-dcd431ac4e89","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c8efa4d-31f6-509c-b495-195e4a8c0af9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0936daeb-e3a5-5f39-82d5-682b4b91909a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93684044-f885-5eca-9061-6041869fc324","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--affb609b-ad0f-5a94-8202-0d035a0ba005","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cbbec75-72ac-5e6a-b77c-606412567a9b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac840956-315f-5fd4-9331-55fd5417814a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c07fc6a2-e880-51e0-9e90-e52ea654a56b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--202984e9-d900-5cec-9aae-e5f9ab22168a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx4ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx4ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc113f07-db63-56f1-a4b6-1e590af30d0f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx4ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx4ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--797780ce-2032-5a0c-988e-ad6abe9577b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"otx3ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'otx3ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28b116a0-7229-5d47-b11b-6411b8fd56b4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://otx3ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://otx3ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f47d790-cfad-5d33-af36-2e8403d61feb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78f8afe5-8c12-5cd8-938e-5bff1a356018","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--230890ae-b476-57d7-a183-70fddb9ccfca","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8943b9a-c045-54e2-8894-3698c2bbc487","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d2f3a8-db42-5a92-be6b-09845415bf0a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"otx19ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'otx19ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2f2e90b-c4de-53f5-bb61-7ad69b96ed67","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://otx19ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://otx19ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72f095fe-2394-557f-b316-ed6cf86751c5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f81d08b-e742-5554-bd15-a6a635df4ced","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59f531d9-dc2c-52bc-b972-8af9fa230821","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f6f9cb1-5c68-5760-998d-13b69a0df46d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e12eb644-51bd-5edb-aa56-74f09bcab31e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df539b36-9bc1-5a5f-817f-e3a72a4dcd46","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0046bde3-3de4-5b97-93da-cafcc98a9d6d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39d49e03-f6ab-59f2-b379-1b02f46c20b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aa179fd-50b2-53e0-bcac-42add4e21862","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87557fb9-6725-50fc-8609-bc5ecfe30a29","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af69701a-d8f2-5a01-a3b6-5c489c2d660f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37c92d7d-9e3c-5575-8929-ed95dd813526","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c02807a-aff5-5e3b-aa4f-cb1165d79280","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f3cabee-58b3-53b9-8a9f-5cb029ce0b72","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0110313f-ae73-5dab-8b74-5ef4027ef5cb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23454d60-4d49-5fc6-96a8-7e4d8194afa4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ab1e0c4-ad38-5ac8-b571-9091b018fc0d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr6ies.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr6ies.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2562798-1932-5491-a5cb-57b43c4a36be","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr6ies.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr6ies.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f083480a-7ce6-5b58-a1ad-5c1e26b9d61e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr19ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr19ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--840fd5bb-afa3-5fd7-a237-7b2cd3cdcbeb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr19ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr19ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05c543f0-1af0-5ee5-8876-1c18f24e9645","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--716fba16-d20a-5e82-a7e2-a6703d67dd0b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--587c4695-fc55-5f58-960e-b41e64067062","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19a53879-d52e-5faf-8256-bd16d828aeac","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf4ce767-90dc-5857-99cb-4c2b529160ce","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--961c11cb-fbf8-5fce-9d3b-c3c6c7a8d72e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7ce43d9-3f8a-5b25-b62b-9aac5570b107","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da0ea29b-61cf-5517-b71c-d8770e5f28b4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a4f903a-4c4d-5813-bbda-b18354386839","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3aed6ea-6438-55da-a742-0fe09ec8a14f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--235c596c-05b9-595f-86fa-9d51a0ac8ee7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52417c44-75d8-5eca-9bf3-dd6dd1bea454","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3281d5a-d278-58a6-ba2e-08a93d7b9fe6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"txis3eo.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'txis3eo.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a030a460-25c8-5a8a-a0f1-2f1c53002bcb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://txis3eo.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://txis3eo.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52c72774-7836-525f-a570-b1cd008d660c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98b89c71-f3cd-5d15-9dfa-dc987d4ceede","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a21a6b2f-527d-5b3c-abff-4fb6c867191d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nav-logins.nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-logins.nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b00fa0a-5b19-53d5-bdf4-9b578368e9c5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nav-logins.nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-logins.nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fcc8d6a-2d21-5ea2-b245-342c4bb02472","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67462219-58c8-50d4-95f1-7fd6128d9d0c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--457183ec-46f4-5898-a464-318cfa6eff3c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--610bb3cb-0b08-52bb-9297-4efbaad537c8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2cd7cea-3669-560f-a098-37d567b50570","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"pntxes18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pntxes18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae5cc4c4-5116-5e10-a5f6-bc5f6e9667c7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://pntxes18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pntxes18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2babdc92-c565-55d2-8b12-208d9ef78a83","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itxa16ns.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itxa16ns.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36cad630-f6db-53cc-a478-5176ff2180d2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itxa16ns.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itxa16ns.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f75d8c-6c59-5b81-bd5f-98d4c7f044b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71a28e7b-e317-5969-8b6d-1d0b3845e20e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63388418-d77f-5067-8950-7f18cc61cdcc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx8ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx8ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7009e7a2-eb0e-5093-bebc-27bc3c371a7d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx8ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx8ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--856798d1-532f-55be-986d-2b630326fd73","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68e9e894-290a-58ad-9eaf-c6df43d9bb9d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b098b2c7-419e-541f-93e8-98a121a1f54f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d798e74-c5f1-5c35-969a-45edf9eb9382","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd4908d2-6940-55d2-9de4-f1def7b8b142","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tpe5ie.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tpe5ie.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65153266-9000-5c19-8bf5-5b63c65e19c2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tpe5ie.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tpe5ie.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ad5ed5-09d4-5b91-b724-44daa486be33","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tois15ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tois15ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c378aae7-08e6-538f-b47a-2eef46f070c7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tois15ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tois15ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cfc6335-4e2e-582c-83c4-3bf8bbbccbcb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"xto14ic.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xto14ic.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69d9ce71-010f-5f41-a2a8-c4d5d286d1bb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://xto14ic.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xto14ic.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bb0ffff-10fb-54ad-bdf6-10e235c49550","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntx10sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntx10sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42c60311-0c3a-5acd-ac16-e51034552280","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntx10sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntx10sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6840f72f-b425-53ca-b4f0-07c1f9360ffd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b56d7efb-2e5b-5bfb-bcb3-e5bee577565f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e30b5b0-c5e5-5521-8be2-1265dc3993b6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois0ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois0ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b378c3f-a473-51b9-9f19-8d3c45ea57e6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois0ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois0ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55c8911-d995-5770-a008-55ddc3487557","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois36ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois36ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67a2b798-cf43-596e-a200-4235f8796afc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois36ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois36ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fca4ce3e-a12b-50d8-b819-39580a32a426","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9aff5f62-2833-57c5-8667-3505641a7263","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d07b8782-855f-504f-9ec8-966889db52b8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois39ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois39ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a105554b-3699-5677-be41-1c5b064756bd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois39ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois39ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5d587c-ca4d-537a-bfa3-5958bea5bbc6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cecbb345-2699-5b76-852a-6755b39295df","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--623ca415-0d24-5806-b64d-85099888cdc1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3888138d-6c65-57de-a29e-fac8ac85bdb0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3243689-40b5-59cc-9f62-37339fc7c6ed","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nsc2tx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nsc2tx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4caddaf-549f-5581-8b89-4bee463dd7b1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nsc2tx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nsc2tx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fd30dbc-6a06-5702-87fe-63d7342b3fe0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op10ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op10ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--190d6dbf-8ebe-524f-ba56-c340b1117ab3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op10ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op10ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c21b8740-6c35-5471-be80-3a42626a6236","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c92a457c-676c-5b5d-bd28-eff964153e6c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc636ba5-3cd1-52e2-8875-3c411340d25d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op11ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op11ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6b8fa7d-ff80-5c12-a286-2402ee2bbe41","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op11ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op11ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a746684-838a-5daf-84ed-2965e395fe00","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op27ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op27ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deaf6e74-1e3a-501a-a4df-a86b9101378e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op27ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op27ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a55124a9-a2ca-5af9-96a8-3bdde20d0148","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op34ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op34ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de157869-678e-5476-bed9-fd289ae1c32e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op34ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op34ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c971113e-3198-5084-b4d1-005f398aff16","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op30ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op30ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a553635-69d0-505c-828b-a78c0c3c5569","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op30ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op30ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55d8c8a4-90f6-5dac-9bee-998820bee05e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op15ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op15ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aea4517-e128-55ed-ba92-e2fcb7286ca7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op15ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op15ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e989cd4-a347-581f-94e8-e428f4ce6c5e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op36ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op36ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5135c64-556a-5f7d-8ec2-5b006257262a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op36ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op36ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c95fdf1b-2ba3-5702-ba29-a5f4d42486ad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op19ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op19ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c27b856-6f7e-5591-abf5-186846c7f8c9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op19ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op19ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c95b6e8-5477-5279-a695-11153ce4a750","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op17ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op17ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7760faad-2cba-55e0-8a4a-91be6eb4236b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op17ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op17ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f619bcf-ca2b-5d3e-bf55-d371a4fa9a70","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op24ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op24ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be3dd43a-6f9c-5186-8bed-eb41d34cd750","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op24ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op24ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--716a246b-28b2-5046-ab03-623616b3fa5b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op22ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op22ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b46f20d-6492-5056-8733-ea709b2bdb97","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op22ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op22ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--432060d8-0ad7-5911-8058-adc44e74cb7a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op28ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op28ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34e2963b-4537-5675-a073-9ff0bb7d20fa","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op28ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op28ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8c809ea-f0be-5d82-8727-1558a3fd539f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op35ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op35ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11328a39-1590-580b-b7d2-86aad8506776","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op35ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op35ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a26c6e3-bd40-537e-bfb5-80094972c61d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op29ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op29ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3172b261-5ff8-548c-b2ae-a03b3fed3967","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op29ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op29ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6146ccc0-2975-5d30-9900-c944e6c0f69a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op25ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op25ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c231db1-1f0b-560e-8c56-faf9c4ca5ac9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op25ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op25ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bfc66c1-379e-504e-ba6b-2eb5af4af14b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op12ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op12ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4849f5d2-848e-5b59-a503-35975ccd3cf2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op12ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op12ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bf15a34-0948-51b8-b1fc-6a9229b90c6e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts8pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts8pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c77db810-00a6-54a8-9e86-f28835ff2080","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts8pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts8pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b984b67-bed8-5cc1-97b0-3cb4ef1d475d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4f07b78-30be-581d-a031-1a4521ff924f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d1a891b-eab5-5029-b72b-e1392cc437bd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66a00bf5-ef70-512a-a9e3-2dc63394a837","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdf29a97-08d9-5eef-a998-909e68bd5884","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0813a96-d42d-52a3-99bb-0758819b9a94","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22cffa7b-b968-5bea-b1bb-c38a455b0520","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68238c67-fd10-518d-8624-ee65e4d41c8b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31b1c247-b954-5a0e-963f-1513acd8b527","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68f5f5e0-4607-5b4f-832c-b41f28c407af","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5e48ae7-1041-57ad-a73d-198dc96d729e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8992882-cc99-5eed-9efb-5e3f377f8e11","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7429f3ad-1b25-5e6f-bb66-0201dcc24465","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--924e46c0-639a-5590-b7bb-55ca44658463","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34ea1831-d488-58c9-97f8-9e033785e9db","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eef8580d-a037-5836-b519-12621bce7ab8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6655e4fc-68f8-5928-ab48-971c44720e84","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--799a7c41-d9ab-5fde-9cc7-97f47fed7df1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec4c03d6-f3c4-5217-87a7-73eaf1d5bfad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7af229f8-ccd6-5238-9d5d-c0d37d6c8be9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0341ff48-9041-5d0d-ae9a-d8979dfafc3c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp32s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp32s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61b6e22b-3913-5a1a-a869-1308cc1aa0a5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp32s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp32s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d64bbfd-fa2d-5b4a-a3a4-1af173028fb9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bbeaf34-1337-52b0-b3cf-8d8e8f0cf81b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ef92f7d-660e-546d-956b-a6fe4a53279b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp35s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp35s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c563cdb1-06e0-5a44-9c33-83fd015aeb98","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp35s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp35s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04bc7b1b-bb88-51ab-a60d-f2cf48b1d4e5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--415ec302-98ad-5756-9dff-72e3397d8c3f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5de7dd6-1d06-5c63-806c-80aa3e7469e6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90b47951-77c0-572a-a28b-28304ae8d219","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2ad66fb-2cf1-58b6-8640-3f86c3fba069","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp17s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp17s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bec4bcc1-f4e1-5fdd-852b-c7d4705f7e69","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp17s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp17s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64449ede-35ab-5add-8584-380b4efcfd99","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp11s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp11s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3096d162-3e76-5616-bafb-068b7fe5038e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp11s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp11s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bbab365-725a-5532-9c06-37823c1daaeb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f21220b-1cb2-5497-8844-d2d584536aca","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3ff1b4f-56fd-5990-92ed-751fdddd1bd1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp9s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp9s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dc4200d-bcd2-5edf-954c-9fc0afb30b0c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp9s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp9s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f19de688-bb0a-5078-987d-a8871f619920","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d05d44ca-c9e2-5dc7-b1a1-5f4b10e67ad7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13311450-6b00-5cb5-a8aa-cabc10be20af","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--518695d8-146f-55e7-ada9-ea01438ba77e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bdc686a-7850-5581-9852-3cf2214841ad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp37s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp37s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07cba164-35f0-55ea-b250-9faa43bcaa75","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp37s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp37s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f193b22-ace5-53e9-b1da-8e5b619b6882","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58c0e8c0-8743-5140-8831-2c775af810c5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c3bbd14-c6df-53a7-a2d7-264c40ae445d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp21s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp21s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f32f847-1fbb-5394-a606-eb8c6e783c30","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp21s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp21s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5628195-aa11-54ef-96d5-887473a29874","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp6s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp6s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cce77cf-6199-55a9-99fc-0e6fc409d3e2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp6s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp6s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8c3399a-33cc-5f43-8c16-53bac9d98b15","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp4s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp4s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57699688-5964-52b2-94ed-0d56abd247b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp4s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp4s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0caadb30-1d96-5bbf-972e-248a6544eebc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp8s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp8s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ff629d9-4524-50d2-9cef-551497a2d5d5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp8s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp8s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce1764d3-65b1-5aa6-966d-c869d5eeee52","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"pntsr27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pntsr27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c4922d2-5fde-5b14-ae67-59fe971d6445","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://pntsr27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pntsr27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d8c48e-ec05-5c77-9e9b-b2f156f682f4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"xn--n-cop-iyu.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xn--n-cop-iyu.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7a5cacb-de53-572a-9983-caaf87cdb98c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://xn--n-cop-iyu.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xn--n-cop-iyu.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ce6c243-b4bd-5f72-bf71-647fb1752e2a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"n-crop.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n-crop.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--335f818e-2bf6-504b-b1b9-c8994bc06914","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://n-crop.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n-crop.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b8e8dc0-f88a-5e74-8a99-f48a0899e7b0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d71044b6-691c-5943-91a0-4dc6c97b857d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0ca250e-eed8-5c56-956e-3d20d0e2f1c1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"pntxes20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pntxes20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a30dcb7-91ae-50aa-b6c6-2ead9c4e8324","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://pntxes20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pntxes20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6b86bee-8459-56c3-b916-e9906a62e2bd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf8f318-27ac-5ffb-824b-74a522ddf85b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--961a9e08-4513-5b87-929a-06c5980507ef","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42ba81e3-56c6-5e38-b33a-42b259e7ea40","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e7f3a51-1ae8-56a0-ac86-b7875224ed2a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno15s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno15s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dd5464a-585a-5894-a916-451b364c5836","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno15s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno15s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82be1c02-296d-5bc0-8218-066fde69ff6d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno10s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno10s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--315f3bc3-0e9f-59e0-8c7e-6a3b9747082b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno10s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno10s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb4e65e9-71f6-5c38-acbb-1eb21ab0ded1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxdoe0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxdoe0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a901ee67-cfca-51ee-afba-84b42d9fed8c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxdoe0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxdoe0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c61efd61-3c77-59aa-835b-2de4a04426a0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos38s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos38s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84fb5111-2b65-5995-a1e8-de90f1d39e25","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos38s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos38s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3cfcd76-acf0-5168-89e3-c20cc945cfb3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxdoe2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxdoe2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5651e90b-30c2-58c7-ad32-41b9f6ca421f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxdoe2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxdoe2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00c615bd-747a-5e33-b722-0599b74ceed1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ea3390-a83a-5b97-ad52-71a30ae80c19","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a9feb7d-affb-507d-b116-a0a79eacecab","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos3s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos3s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3efdaeef-a72d-5e94-b639-6c7190145463","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos3s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos3s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4af99b6-689f-54f3-b301-d0d1307a73c9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.bnav.iterpost.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.bnav.iterpost.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c012499-f7e7-573c-8cfa-c89a34891fbf","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.bnav.iterpost.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.bnav.iterpost.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63a03276-3a6a-521f-95a0-8d1602eb8493","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"n-store.enav.ipspcoep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n-store.enav.ipspcoep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78e347ee-c9fa-5735-b511-02684c3d7ba1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://n-store.enav.ipspcoep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n-store.enav.ipspcoep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b3d3801-3ab6-5a99-935e-e542b3662123","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be5255c7-64e5-5298-8091-2463d0e7abb4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abf1295f-87bd-5c4d-8a2e-35d7fd68bfff","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3e95d3b-4b75-5223-a508-6c87108274fc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a26cd03d-c68f-5a39-8989-99d1bd99376e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.cnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.cnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c593a4b5-5a2d-526e-98da-858388c272f4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.cnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.cnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b22293f5-6ace-5837-98d4-e0f040bb3238","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.enav.ntxthom.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.enav.ntxthom.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3721d9f6-eec6-5322-95e3-8be4cbdbb4f8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.enav.ntxthom.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.enav.ntxthom.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c10275e-9a8e-562f-8d50-26a20f0540bf","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.anav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.anav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec17b2a-ec80-5820-9584-21d33fb1cda6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.anav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.anav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bf73ed1-5159-5dcc-8224-9c8c31bfb5e8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d255922-9e17-57f3-b90d-d34ab883cf3d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e61d79d4-07f3-5d7e-8bbf-23f388e1a1fb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4639c5da-0542-5a3b-bb90-1f1cefa8fa11","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e5c1dcb-40f8-5f04-9421-cfe1ca02db08","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.cnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.cnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4feb992a-8db3-5223-b8a8-9bbcdb37b072","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.cnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.cnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ebd2e45-c8a0-5870-aa9b-f17bcde814e1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20a8648b-077d-52a7-92a4-d6b10c3cd885","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d558940d-3e10-590c-bbdd-f0ef9253e656","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad39c849-a399-50fc-b8ff-2b6728dc1aa1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e6c222f-b3a7-548c-8b51-1c4710430840","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d053e531-e5d4-5cf2-8da6-eae67c8c9312","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac2af067-7e4f-547a-8569-10f6ba6f18a9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.dnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.dnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f09d16f4-251f-5fcf-a8f3-b5210fc40da6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.dnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.dnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaec2a5d-4a9e-51b2-9351-ee6afc760294","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3f10bf6-1429-5565-a382-fa9c659e2fbd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--561a1558-f165-5eb1-b6fd-bec9a7823cde","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8c40199-27d6-5731-af8c-a38fa6885071","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--696060b0-b0e2-5818-910d-576ac178c578","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.en.ntopeds.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.en.ntopeds.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27eb145b-65ea-5475-8e94-271c288b76f6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.en.ntopeds.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.en.ntopeds.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4034ac8a-f428-5fd4-9e01-d863ccca0984","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-servers.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-servers.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--911c45fa-e68b-53a5-b994-63c0a8ce2efe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-servers.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-servers.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3775727d-25fb-5173-89e3-a2612c7554ff","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navorlogins.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navorlogins.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9bf8c82-dcee-5291-8021-4877cff125ce","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navorlogins.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navorlogins.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cc51da3-22d7-5c88-b5a4-b1a0c91c464b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.an.dpsipes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.an.dpsipes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d2d79e3-6185-5849-bbd8-f194e211e3ed","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.an.dpsipes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.an.dpsipes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50fb40d7-c026-5e8a-ac72-c357de0a440e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.cn.cofipdo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.cn.cofipdo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae30f4f4-de62-5ae8-b286-08301a53fd28","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.cn.cofipdo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.cn.cofipdo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63bd5668-a791-5db2-9403-3d35955926d1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.cn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.cn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f0b373b-a3e0-555c-bdcf-7751b87f7b39","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.cn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.cn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efe22b70-9071-5d88-b2b1-4b5739c3036f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.dn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.dn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14576f13-5e2b-537d-9007-4abf6c0d1a69","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.dn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.dn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b94cb84-6114-567e-b796-b75d19c12b5e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--022338db-2a7f-520e-8a49-627a6822cf2e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd28fb48-0f6d-5652-a468-9b817bf98705","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.an.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.an.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--287619a4-b9d5-5d81-a141-661610e62e7a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.an.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.an.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29a9be54-c146-5487-881b-4908e6348cdb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.dn.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.dn.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3db15217-6534-5ed9-a93b-7c6b33cd481e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.dn.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.dn.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4363a157-3c14-5e2c-bbd2-34d37caed73e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navlogs.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navlogs.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e2585c2-80b2-5cc2-8a42-8beeffea70c2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navlogs.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navlogs.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d4297ad-475b-5b7a-b2c7-169de8230250","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f42b207-f299-58c2-befc-1dc0d59050eb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8411877b-2cdb-5c16-a4a9-7e54df5c40ca","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18163e56-cbc9-56e6-af0d-8e69dda4f634","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--786f7a45-c122-50e3-a525-87260a008899","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nides.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nides.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--143faf89-1870-5749-bb04-2df10bad57c9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nides.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nides.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9094b6b2-fd0d-55f4-bdf4-be78c923fbf3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3666b1e0-9b6e-52b5-895e-b5072beafca4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50b459fa-5c70-50bd-8d5f-4ff48d243024","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts.en.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts.en.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ba2e4c4-e2b9-5508-9e8a-ab7b96a98ab5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts.en.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts.en.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0d88f2e-1980-5c17-a18c-2b7bb7546130","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e01fe71-37d8-5c5f-9192-119e22b92cd8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bfe0baf-71f6-5bb7-99b2-adfe1706128c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e380a9a1-dcba-52fd-9955-a3d68f6da97c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f899575-760f-501d-b924-a230395c1071","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.napses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.napses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c158f879-7b25-5f04-a78b-b6d8a09e48a7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.napses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.napses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--229d7db8-8c35-5a65-a566-1805c68c99d3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9e734a6-ee7c-5bdc-9fee-24085d48eb33","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2225dfda-970c-5891-bbb6-1402fd72043a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dffc3e7-5365-5e18-85f6-d05c9b466118","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ff0e0d-dbd4-5c55-938f-4e269afb959e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"random_switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'random_switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--090e971c-7b4f-588a-9077-0e678e07eda6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://random_switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://random_switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6587d0bc-66b5-589b-b2bb-a1702db91255","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f6382a6-99e5-5084-92b9-038ccf5e415d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb6b9094-e2a7-5839-a2d9-e11b8b8fa92b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1ce30fa-7473-523e-80c8-f8c84bb037fd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb6b9512-89c9-5c34-ae72-ad505429dbf0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b509e6c-182d-5486-a74f-d887bd40314e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dbc128b-06d2-5a02-bcf9-94b1ae335103","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f54144c-cab1-5abf-8422-e571e91124ab","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c3e03e3-ea92-5d63-85e1-e483d1fe6580","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba5ee5f7-cd06-5b85-b394-ea073a1ff3bc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--096f621a-8bea-521c-874b-30a8cd03cdfe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18874a46-5312-5ade-9f95-2e7125b9e213","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa0e5809-b4e7-5ee0-888c-52694de13463","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e03b760-3555-5e72-9e3d-ae0d236ff9fe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5785d8c-2b7c-5155-8524-3fb2253de57e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aea4cc9e-5a1d-54ad-8fdb-eee5308ecee4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b570c34d-4845-5f41-a6da-bdbe5c4c9c64","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40eac9d6-f709-53a3-9cb4-e045f09b6f2d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b203d94-71f1-5c08-b276-8a39c24764f8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1caeaa95-247b-5b79-b064-2d704f5767fe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a190fe1-08d4-5139-aa14-e7f73d27b668","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e12444e6-36dd-54bc-a952-8351c9d48100","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc39afe-f89e-58f6-bff3-0afc2eee7ffb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddb77648-8813-5dab-94dc-5a4908695230","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d844df7b-7306-5856-940b-0db18e1ada53","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3252cc6b-7a7d-5676-9c3a-5a335d51587e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e058061b-e27f-5411-8386-3ef5a464d3df","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nesever.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nesever.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c9b410a-8562-5aae-bc0f-18b2fd40e6dc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nesever.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nesever.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0779ed53-5c4d-52b4-88e9-2bd14e3fc727","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ndocs.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a245dbee-af99-51df-98ce-a214cf9c023f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ndocs.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f76dfb03-32ef-5302-b91b-4c01bd4f1097","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nesever.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nesever.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf99978c-dbb5-504f-8e97-926952a50a7c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nesever.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nesever.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d444bc37-81d0-5e98-b2c8-db1822525e57","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ninvoce.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninvoce.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--302d4c87-8eac-56ea-9b3c-93d84bbc86e4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ninvoce.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninvoce.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59665f20-613a-5abc-898f-79b4fc7c5b35","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nesever.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nesever.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07fc2f17-0bfc-588d-806a-f8786134d038","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nesever.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nesever.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22b442a0-c027-5b89-ad83-56b2a47f9d8a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ninvoce.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninvoce.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee3bf4cb-0662-556e-b063-6a4937276f7e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ninvoce.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninvoce.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39397fef-7eee-5b98-b5c1-89ff74c1c097","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidserver.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidserver.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--910f2557-a64d-5579-9556-916615897432","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidserver.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidserver.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fefd7951-c6e5-53dd-89d0-41c52eef3b70","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b8b3d78-82fb-5014-8b9a-04e16dcabca4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3af7abb5-1caa-58d5-aac0-ab5d12fca77e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ndocs.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e95360e-1f5a-5b61-ac2f-4d389bc47f7d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ndocs.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60218afd-4a24-5ce0-b46f-9a65bad0fb45","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad1212a2-1190-580b-a30c-22bde039b934","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--823e8218-f208-55aa-be6f-dea855737eb9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45d7d0a9-8ee9-5d4e-a402-cff56b23c415","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc95c00f-fd40-545e-8ac6-c60d67652dbd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bed78b2d-0c07-518e-b788-723f31338fc4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d0a5ec9-6183-536e-a3f6-b7693e5f4495","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d07aa10d-1647-5582-bb65-99187d44cf7b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e34521f7-c145-5776-964a-a0a8d69a3b5a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7f67927-bcf4-5db4-84d2-c81308f4ce4d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0766f9d2-e24d-5740-81e0-cb015559246c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nav-logins.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-logins.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--936500cb-4933-5acc-97ef-7b03a286be76","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nav-logins.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-logins.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54ec2426-7795-56d9-a432-ecb8049d4561","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--805cf46a-5ccb-56ad-8c3b-949f395dcba6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d69b4b05-03dd-5aa8-b88f-0a0ed16b0b44","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--affaca0f-d004-5496-acc2-b7f9061890d0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6affec29-1876-58e5-bc05-58d2e5c27eeb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4e6f581-f4b9-5120-9f9e-981e966d2d41","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a76c5d9-8356-547b-a9f3-b52cb468b15b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nav-logins.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-logins.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04d359a7-16f1-515b-abcf-57f6348b8f83","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nav-logins.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-logins.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63931c7e-3879-5f3e-bd5d-a6eaa35254f0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2a55560-ef1b-5270-8d17-72b36b1837ad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09ca9c85-83f0-50a9-9d8b-6c781198c580","created":"2026-05-13T19:08:00.000Z","modified":"2026-05-13T19:08:00.000Z","valid_from":"2026-05-13T19:08:00.000Z","name":"http://176.226.230.116:38215/Mozi.m","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://176.226.230.116:38215/Mozi.m']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054639827790815397"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4be1a286-430b-5fe3-a8f1-66451bafe812","created":"2026-05-13T19:08:00.000Z","modified":"2026-05-13T19:08:00.000Z","valid_from":"2026-05-13T19:08:00.000Z","name":"176.226.230.116","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '176.226.230.116']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054639827790815397"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a42dfe25-1176-5f90-8e5b-bd76be6877b3","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"http://142.248.80.144/lol.sh","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://142.248.80.144/lol.sh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--172f03b4-a27c-50be-9793-c6c040e17dca","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"142.248.80.31","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.248.80.31']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e56546b-46fe-5f7d-947c-f923469f3fd0","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"142.248.80.144","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.248.80.144']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f8ed644-a407-5104-a597-9940ba1ccf1a","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"8ae5e4a4c875e45975faf989dbf83214","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '8ae5e4a4c875e45975faf989dbf83214']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b191dcb5-9de6-5f60-a48d-6e5f91a93100","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://179.43.177.220:8080","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://179.43.177.220:8080']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0511db0f-4ccb-5077-9f2f-ccb511f98385","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"cdn.bgpweb.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cdn.bgpweb.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f39d916-65d3-57ed-99d7-f50b946a51e9","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://cdn.bgpweb.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cdn.bgpweb.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f3168d6-89b4-5510-9cc4-a3c62036ec49","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"timetrakr.cloud","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'timetrakr.cloud']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee00ae3f-c7ec-5cd8-a874-849c2cab0a46","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://timetrakr.cloud","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://timetrakr.cloud']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94ea2ee3-b4ba-5c47-bc96-94b8c35ce380","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"timetrakr.sbs","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'timetrakr.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d1ed258-4caa-5540-8172-7dbdfadd6a75","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://timetrakr.sbs","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://timetrakr.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcb436ff-d2de-552b-8524-806d48c608b5","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"179.43.177.220","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '179.43.177.220']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e00088e6-fc94-56d1-97ca-0318d2bbed3d","created":"2026-05-13T20:00:00.000Z","modified":"2026-05-13T20:00:00.000Z","valid_from":"2026-05-13T20:00:00.000Z","name":"bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054652938425876792"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02ced8a7-74a2-58a9-8d33-949aa4d5dca7","created":"2026-05-13T20:00:00.000Z","modified":"2026-05-13T20:00:00.000Z","valid_from":"2026-05-13T20:00:00.000Z","name":"https://bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054652938425876792"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3d51458-5c5d-5d23-93b3-1ba76b552187","created":"2026-05-13T20:51:00.000Z","modified":"2026-05-13T20:51:00.000Z","valid_from":"2026-05-13T20:51:00.000Z","name":"driect-shk1na-c.com","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'driect-shk1na-c.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054665909990834656"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e125b5be-fb69-598b-b4fe-919957fff485","created":"2026-05-13T20:51:00.000Z","modified":"2026-05-13T20:51:00.000Z","valid_from":"2026-05-13T20:51:00.000Z","name":"https://driect-shk1na-c.com/htm/sh1n/selectState","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://driect-shk1na-c.com/htm/sh1n/selectState']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054665909990834656"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07e44262-7afd-5fd5-858c-966503fbe0c2","created":"2026-05-13T22:00:00.000Z","modified":"2026-05-13T22:00:00.000Z","valid_from":"2026-05-13T22:00:00.000Z","name":"correo-issste-gob-mx-owa.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'correo-issste-gob-mx-owa.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054683139654479996"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--341d42ee-26cc-5d0f-bd50-71234b88b02f","created":"2026-05-13T22:00:00.000Z","modified":"2026-05-13T22:00:00.000Z","valid_from":"2026-05-13T22:00:00.000Z","name":"https://correo-issste-gob-mx-owa.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://correo-issste-gob-mx-owa.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054683139654479996"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c70b7fe-84b3-51ad-babe-ee4fae19d947","created":"2026-05-13T23:05:00.000Z","modified":"2026-05-13T23:05:00.000Z","valid_from":"2026-05-13T23:05:00.000Z","name":"rakuten-card.gfhrtt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuten-card.gfhrtt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054699527420973255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7df504ff-aa63-5efc-ac5d-cbfec9fa31f6","created":"2026-05-13T23:05:00.000Z","modified":"2026-05-13T23:05:00.000Z","valid_from":"2026-05-13T23:05:00.000Z","name":"http://rakuten-card.gfhrtt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rakuten-card.gfhrtt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054699527420973255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a07678-6b71-5595-8109-c26c75cf7ddc","created":"2026-05-14T00:00:00.000Z","modified":"2026-05-14T00:00:00.000Z","valid_from":"2026-05-14T00:00:00.000Z","name":"biglobemailservice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biglobemailservice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054713353105244205"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9cea1be-6b4b-5a45-a415-66ca70ddd034","created":"2026-05-14T00:00:00.000Z","modified":"2026-05-14T00:00:00.000Z","valid_from":"2026-05-14T00:00:00.000Z","name":"https://biglobemailservice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://biglobemailservice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054713353105244205"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84a3ecf8-8b0a-5ca5-b0b4-13fa8b495302","created":"2026-05-14T00:36:00.000Z","modified":"2026-05-14T00:36:00.000Z","valid_from":"2026-05-14T00:36:00.000Z","name":"hhxpvpo.bond","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hhxpvpo.bond']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054722396893122799"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b5bcd34-5be0-5e0c-83ad-618803d92f40","created":"2026-05-14T00:36:00.000Z","modified":"2026-05-14T00:36:00.000Z","valid_from":"2026-05-14T00:36:00.000Z","name":"https://hhxpvpo.bond/source/A9QLGXnyX47T","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hhxpvpo.bond/source/A9QLGXnyX47T']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054722396893122799"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bc9ec7c-3378-5b53-8fa1-5f4c8ca807ce","created":"2026-05-14T00:44:00.000Z","modified":"2026-05-14T00:44:00.000Z","valid_from":"2026-05-14T00:44:00.000Z","name":"d08b9af78ec25b65523967d2517d4d9d8dcd1068fca605288462cfd968ef5aee","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd08b9af78ec25b65523967d2517d4d9d8dcd1068fca605288462cfd968ef5aee']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054724510319079833"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f796f6a-57b4-5f5c-bac5-d33cfdc51403","created":"2026-05-14T02:42:00.000Z","modified":"2026-05-14T02:42:00.000Z","valid_from":"2026-05-14T02:42:00.000Z","name":"http://github.com/happydream9028","description":"IOC reported by @MalforsHQ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://github.com/happydream9028']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MalforsHQ/status/2054578037438517524"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1a41da7-c51b-5dca-a5cd-4426574038f6","created":"2026-05-14T03:43:00.000Z","modified":"2026-05-14T03:43:00.000Z","valid_from":"2026-05-14T03:43:00.000Z","name":"beachjiujitsu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'beachjiujitsu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054769662580379837"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd04462f-c234-5aba-9fdb-c77e05655944","created":"2026-05-14T03:43:00.000Z","modified":"2026-05-14T03:43:00.000Z","valid_from":"2026-05-14T03:43:00.000Z","name":"http://beachjiujitsu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://beachjiujitsu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054769662580379837"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d72e7ba-2e92-5e36-9e6d-d6ee85ef4357","created":"2026-05-14T04:18:00.000Z","modified":"2026-05-14T04:18:00.000Z","valid_from":"2026-05-14T04:18:00.000Z","name":"cherepahanataha.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cherepahanataha.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054778413232353488"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46b5db09-66b3-5a4d-bdc8-b07143967404","created":"2026-05-14T04:18:00.000Z","modified":"2026-05-14T04:18:00.000Z","valid_from":"2026-05-14T04:18:00.000Z","name":"http://cherepahanataha.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cherepahanataha.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054778413232353488"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96f6fd1-a07d-50d0-a760-f9291277ab94","created":"2026-05-14T05:00:00.000Z","modified":"2026-05-14T05:00:00.000Z","valid_from":"2026-05-14T05:00:00.000Z","name":"mem.calcuttaswimmingclub.com","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mem.calcuttaswimmingclub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054788822571815004"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15352cd-2491-5d50-9ef1-de2c316bfc07","created":"2026-05-14T05:00:00.000Z","modified":"2026-05-14T05:00:00.000Z","valid_from":"2026-05-14T05:00:00.000Z","name":"https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054788822571815004"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8eec0043-844a-55e3-8129-41238ea20650","created":"2026-05-14T05:15:00.000Z","modified":"2026-05-14T05:15:00.000Z","valid_from":"2026-05-14T05:15:00.000Z","name":"ntc-firewall.safeurl-content.online","description":"IOC reported by @__0XYC__ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntc-firewall.safeurl-content.online']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/__0XYC__/status/2054792675887382660"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c325afa4-7bb7-56ad-98ac-ac46f99d60be","created":"2026-05-14T05:15:00.000Z","modified":"2026-05-14T05:15:00.000Z","valid_from":"2026-05-14T05:15:00.000Z","name":"https://ntc-firewall.safeurl-content.online/opx/mailflair/r/EZ6n6FMhSh","description":"IOC reported by @__0XYC__ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ntc-firewall.safeurl-content.online/opx/mailflair/r/EZ6n6FMhSh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/__0XYC__/status/2054792675887382660"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7c2c796-db9a-5ab7-a427-bff692eba675","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"login.lbbacx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.lbbacx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab1e309-aac0-532a-87d7-3d79ed7f0423","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"https://login.lbbacx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://login.lbbacx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--873a7e6d-25f0-5690-8ad6-b315090b4c79","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"35.219.189.153","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '35.219.189.153']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7661862-fa29-5f74-8fbb-4a75ad442c72","created":"2026-05-14T06:00:00.000Z","modified":"2026-05-14T06:00:00.000Z","valid_from":"2026-05-14T06:00:00.000Z","name":"wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054803961001939254"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f72bc547-4d0a-5e78-86d2-b025286f8b51","created":"2026-05-14T06:00:00.000Z","modified":"2026-05-14T06:00:00.000Z","valid_from":"2026-05-14T06:00:00.000Z","name":"https://wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054803961001939254"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c974e11-2703-50fe-8a25-33b449c49d9e","created":"2026-05-14T06:06:00.000Z","modified":"2026-05-14T06:06:00.000Z","valid_from":"2026-05-14T06:06:00.000Z","name":"194.163.148.133","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '194.163.148.133']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054805615269298684"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d5336b3-34a5-5c72-b96a-b12aa197562f","created":"2026-05-14T06:06:00.000Z","modified":"2026-05-14T06:06:00.000Z","valid_from":"2026-05-14T06:06:00.000Z","name":"892aa7559852a22b8bc7a38df7c2f2cdd866e4c28a8177d80df6190d2eb6a78b","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '892aa7559852a22b8bc7a38df7c2f2cdd866e4c28a8177d80df6190d2eb6a78b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054805615269298684"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44da8abc-989e-5b37-9f57-f2cf025a62dd","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"rqvzkqb.shbllgs.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rqvzkqb.shbllgs.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054806822914232688"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90b621dc-1602-50ed-ac69-2fd26b0a16fe","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054806822914232688"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d4f3048-0623-5cf8-9c7f-c2e6b826f4ac","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"login.ztjbbx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.ztjbbx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--479de88d-3bc2-58d9-9258-a5dbe57191dd","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"https://login.ztjbbx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://login.ztjbbx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a552f54c-fb54-55f6-8b82-a96e78ba67bf","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"35.219.141.232","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '35.219.141.232']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5d838f9-3389-54c6-8aff-6e732460c86b","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"172.239.129.158","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '172.239.129.158']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8996fe5-fdd0-5d2a-bd66-d670f6c74fbb","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"8a24907655a03f0f8b4991cb22a07c4f9e16626260f6dbcc748fbb4dc4720508","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a24907655a03f0f8b4991cb22a07c4f9e16626260f6dbcc748fbb4dc4720508']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e0d2148-eb2c-55fb-ba5a-c97f048e0820","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"8f2e5ee9a87752e1b0626dd2bb754aaa2f9d8ef19d3ae448a06d3c38e647b6d0","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8f2e5ee9a87752e1b0626dd2bb754aaa2f9d8ef19d3ae448a06d3c38e647b6d0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7035da5c-f6f9-506f-89d8-292de6ca828c","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"dsrzzi.jetgq.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsrzzi.jetgq.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7695193-008b-5d2c-a0a1-5d33f68909be","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"https://dsrzzi.jetgq.cn/jkautixtf/londut/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dsrzzi.jetgq.cn/jkautixtf/londut/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5c850a1-fcd9-5097-8622-b61d7d7d450c","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"sufesuzu.z7.web.core.windows.net","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sufesuzu.z7.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--53dc60b1-b4d7-5274-a01f-ab1049a0487b","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"https://sufesuzu.z7.web.core.windows.net","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sufesuzu.z7.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--16422871-509b-5764-a4a7-f4193e37c81e","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"171.252.225.139","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '171.252.225.139']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--162040b9-a741-534c-af77-e7389df9757c","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"20.60.131.1","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '20.60.131.1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4fc2fea-66c6-591d-a119-02570e97df75","created":"2026-05-14T07:33:00.000Z","modified":"2026-05-14T07:33:00.000Z","valid_from":"2026-05-14T07:33:00.000Z","name":"109.199.111.106","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '109.199.111.106']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054827500946194546"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78abfe58-caec-5f0f-bfd5-f7df5270134a","created":"2026-05-14T07:33:00.000Z","modified":"2026-05-14T07:33:00.000Z","valid_from":"2026-05-14T07:33:00.000Z","name":"13.59.222.135","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '13.59.222.135']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054827500946194546"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--756fd61c-8004-579c-9fe2-92844bf11393","created":"2026-05-14T07:49:00.000Z","modified":"2026-05-14T07:49:00.000Z","valid_from":"2026-05-14T07:49:00.000Z","name":"http://92.118.127.204","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://92.118.127.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054831494347063755"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9a0de17-0783-536d-b887-c08fce158b9e","created":"2026-05-14T07:49:00.000Z","modified":"2026-05-14T07:49:00.000Z","valid_from":"2026-05-14T07:49:00.000Z","name":"nrtcpk-net.com","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nrtcpk-net.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054831494347063755"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea04b702-9e93-5b24-b53c-bc86ab439ae8","created":"2026-05-14T07:49:00.000Z","modified":"2026-05-14T07:49:00.000Z","valid_from":"2026-05-14T07:49:00.000Z","name":"http://nrtcpk-net.com","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nrtcpk-net.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054831494347063755"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1a4aafc-1de4-5f03-abd5-7695f98cbbe2","created":"2026-05-14T07:49:00.000Z","modified":"2026-05-14T07:49:00.000Z","valid_from":"2026-05-14T07:49:00.000Z","name":"92.118.127.204","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '92.118.127.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054831494347063755"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--87588169-324a-561e-a4a1-aaf7ecc0408b","created":"2026-05-14T08:00:00.000Z","modified":"2026-05-14T08:00:00.000Z","valid_from":"2026-05-14T08:00:00.000Z","name":"https://docs.google.com/forms/d/e/1FAIpQLSckViHVkrr3i0ruWf4rTN5pcAaqqMI7Ibp-gHDV-1s8FIJZzA/viewform","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://docs.google.com/forms/d/e/1FAIpQLSckViHVkrr3i0ruWf4rTN5pcAaqqMI7Ibp-gHDV-1s8FIJZzA/viewform']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054834130961956867"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd159386-36b5-5505-9fe5-d8e6e4d35100","created":"2026-05-14T08:04:00.000Z","modified":"2026-05-14T08:04:00.000Z","valid_from":"2026-05-14T08:04:00.000Z","name":"http://104.207.135.174","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://104.207.135.174']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054835110470369738"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8799042-d64e-53fe-9a75-3362d5c13b24","created":"2026-05-14T08:04:00.000Z","modified":"2026-05-14T08:04:00.000Z","valid_from":"2026-05-14T08:04:00.000Z","name":"104.207.135.174","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.207.135.174']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054835110470369738"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9578766a-36dd-5822-8031-07f0947c1e5f","created":"2026-05-14T08:06:00.000Z","modified":"2026-05-14T08:06:00.000Z","valid_from":"2026-05-14T08:06:00.000Z","name":"f1d8ef546848bc42fc9c017e07f1d07b8a1840ae85ba6e5dabc340920a028b56","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'f1d8ef546848bc42fc9c017e07f1d07b8a1840ae85ba6e5dabc340920a028b56']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054835744879870436"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--444b741e-f239-5a16-9e17-7bf65884a439","created":"2026-05-14T08:10:00.000Z","modified":"2026-05-14T08:10:00.000Z","valid_from":"2026-05-14T08:10:00.000Z","name":"60ff4dc97fd6178b8a3b8cf13b543f4ce3d0913c9d4d9e95606236e71c136f1e","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '60ff4dc97fd6178b8a3b8cf13b543f4ce3d0913c9d4d9e95606236e71c136f1e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054836651092746354"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2494131e-03ee-54d7-ae5e-fbbd0d6f2037","created":"2026-05-14T08:47:00.000Z","modified":"2026-05-14T08:47:00.000Z","valid_from":"2026-05-14T08:47:00.000Z","name":"178.16.53.166","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '178.16.53.166']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054845924271382602"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7259b48b-d127-5fc0-9663-525dd4c33ad0","created":"2026-05-14T08:49:00.000Z","modified":"2026-05-14T08:49:00.000Z","valid_from":"2026-05-14T08:49:00.000Z","name":"http://185.186.244.57","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://185.186.244.57']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054846618986299752"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--03c27de3-bbf5-54c1-9654-4d4dee18fad2","created":"2026-05-14T08:52:00.000Z","modified":"2026-05-14T08:52:00.000Z","valid_from":"2026-05-14T08:52:00.000Z","name":"http://185.186.244.57:8754","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://185.186.244.57:8754']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054847214250246458"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa49320d-482b-5f8d-92a6-6207297d41dc","created":"2026-05-14T08:52:00.000Z","modified":"2026-05-14T08:52:00.000Z","valid_from":"2026-05-14T08:52:00.000Z","name":"185.186.244.57","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '185.186.244.57']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054847214250246458"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--65146f6a-9739-54df-985b-779c5d454ba4","created":"2026-05-14T09:13:00.000Z","modified":"2026-05-14T09:13:00.000Z","valid_from":"2026-05-14T09:13:00.000Z","name":"877740250f7187aac3801ac27e127c5999dcc49289a3a7bfebb4004197ed7050","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '877740250f7187aac3801ac27e127c5999dcc49289a3a7bfebb4004197ed7050']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054852476898033713"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9398643-7fe4-5ba4-8a17-e5c71e20a157","created":"2026-05-14T09:17:00.000Z","modified":"2026-05-14T09:17:00.000Z","valid_from":"2026-05-14T09:17:00.000Z","name":"b887a7d8449d37fb777695efe550c32f","description":"IOC reported by @Thisism23567356 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'b887a7d8449d37fb777695efe550c32f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Thisism23567356/status/2054853505374949566"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1996b1c0-87fa-56d5-ba41-b069d9fcf7ad","created":"2026-05-14T09:18:00.000Z","modified":"2026-05-14T09:18:00.000Z","valid_from":"2026-05-14T09:18:00.000Z","name":"http://193.169.194.39","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://193.169.194.39']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054853804529439013"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--21c51a80-f0f3-54c8-a09b-9ea49b0a39d6","created":"2026-05-14T09:18:00.000Z","modified":"2026-05-14T09:18:00.000Z","valid_from":"2026-05-14T09:18:00.000Z","name":"193.169.194.39","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '193.169.194.39']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054853804529439013"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8595ebd7-26fa-5af5-9cee-b8caafb9f662","created":"2026-05-14T09:18:00.000Z","modified":"2026-05-14T09:18:00.000Z","valid_from":"2026-05-14T09:18:00.000Z","name":"9914815d55b02d96e0f6f987822a05c52aefc988459868978f01edcaecda2c41","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '9914815d55b02d96e0f6f987822a05c52aefc988459868978f01edcaecda2c41']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054853804529439013"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4a29e1a-1c27-58bd-910e-399372b0dc16","created":"2026-05-14T09:44:00.000Z","modified":"2026-05-14T09:44:00.000Z","valid_from":"2026-05-14T09:44:00.000Z","name":"burning-coffee-penguin.myfilebase.com","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'burning-coffee-penguin.myfilebase.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054860370896998880"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d40dfd38-5db3-5700-af32-d7045d8a8b73","created":"2026-05-14T09:44:00.000Z","modified":"2026-05-14T09:44:00.000Z","valid_from":"2026-05-14T09:44:00.000Z","name":"http://burning-coffee-penguin.myfilebase.com","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://burning-coffee-penguin.myfilebase.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2054860370896998880"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--332a0156-d90d-547b-8a5d-28f0bcb7c1f9","created":"2026-05-14T10:00:00.000Z","modified":"2026-05-14T10:00:00.000Z","valid_from":"2026-05-14T10:00:00.000Z","name":"http://ipfs.io/ipfs/bafkreidurzcblohw5tttn4gfdoe2rg7z6qfkptnzlav3u7qslkswxs42jy/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipfs.io/ipfs/bafkreidurzcblohw5tttn4gfdoe2rg7z6qfkptnzlav3u7qslkswxs42jy/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054864340621177298"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e881036-c937-5a54-814a-e9e983938e70","created":"2026-05-14T10:32:00.000Z","modified":"2026-05-14T10:32:00.000Z","valid_from":"2026-05-14T10:32:00.000Z","name":"6eb31006ca318a21eb619d008226f08e287f753aec9042269203290462eaa00d","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '6eb31006ca318a21eb619d008226f08e287f753aec9042269203290462eaa00d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2054872420566155546"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fded4ae4-916f-5d20-98de-339696fe6ebb","created":"2026-05-14T11:10:00.000Z","modified":"2026-05-14T11:10:00.000Z","valid_from":"2026-05-14T11:10:00.000Z","name":"advokat.publicvm.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'advokat.publicvm.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054882140169363928"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d85e3e28-00ea-54b2-ae73-3ea22ac68c37","created":"2026-05-14T11:10:00.000Z","modified":"2026-05-14T11:10:00.000Z","valid_from":"2026-05-14T11:10:00.000Z","name":"http://advokat.publicvm.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://advokat.publicvm.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054882140169363928"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--64db6b39-ad0e-5fce-9c7f-57f518182b49","created":"2026-05-14T11:10:00.000Z","modified":"2026-05-14T11:10:00.000Z","valid_from":"2026-05-14T11:10:00.000Z","name":"836db26f88b8124828629f1bcf5e12fe521b56850a4a60b76b350813498c6056","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '836db26f88b8124828629f1bcf5e12fe521b56850a4a60b76b350813498c6056']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054882140169363928"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad3dd27a-0652-5271-ace2-1d4b34a17932","created":"2026-05-14T11:12:00.000Z","modified":"2026-05-14T11:12:00.000Z","valid_from":"2026-05-14T11:12:00.000Z","name":"188861d7f0861103886543eff63a96c314c8262dbf52c6e0cf9372cf1e889d52","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '188861d7f0861103886543eff63a96c314c8262dbf52c6e0cf9372cf1e889d52']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2054882625261543550"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--87d45e55-af82-5ba0-845e-975f43afd7b9","created":"2026-05-14T11:14:00.000Z","modified":"2026-05-14T11:14:00.000Z","valid_from":"2026-05-14T11:14:00.000Z","name":"304912a07d6e434b84dc0c33da3f31000bc5fed74c941e83013390b225c75165","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '304912a07d6e434b84dc0c33da3f31000bc5fed74c941e83013390b225c75165']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054882996751098113"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--84594c8f-b74c-5545-a43c-b234b4c6ea70","created":"2026-05-14T11:16:00.000Z","modified":"2026-05-14T11:16:00.000Z","valid_from":"2026-05-14T11:16:00.000Z","name":"ac28e78d726c18a088400f18e7e37b240dcae84712a2e3cf4bb04cee1cf64635","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ac28e78d726c18a088400f18e7e37b240dcae84712a2e3cf4bb04cee1cf64635']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054883653524545644"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--48c1be57-80dd-5ac0-a914-27eed0df5df3","created":"2026-05-14T11:20:00.000Z","modified":"2026-05-14T11:20:00.000Z","valid_from":"2026-05-14T11:20:00.000Z","name":"photodoc-hub.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'photodoc-hub.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054884464749052286"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0125335-be99-5f2e-8aab-78d9d107cf29","created":"2026-05-14T11:20:00.000Z","modified":"2026-05-14T11:20:00.000Z","valid_from":"2026-05-14T11:20:00.000Z","name":"http://photodoc-hub.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://photodoc-hub.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054884464749052286"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f88e5dba-04e9-5245-871e-77ee3cf56b97","created":"2026-05-14T11:20:00.000Z","modified":"2026-05-14T11:20:00.000Z","valid_from":"2026-05-14T11:20:00.000Z","name":"9048ead904729303f619ae13cf07995e5110c14b6f0948b4410d68e271f38870","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '9048ead904729303f619ae13cf07995e5110c14b6f0948b4410d68e271f38870']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054884464749052286"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bf5d4ab-557f-5599-8069-e14f2a559847","created":"2026-05-14T12:00:00.000Z","modified":"2026-05-14T12:00:00.000Z","valid_from":"2026-05-14T12:00:00.000Z","name":"mask-sign-inmeta2.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mask-sign-inmeta2.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054894597826822181"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eca64cde-3aee-553e-ba10-6ceaa16e39d2","created":"2026-05-14T12:00:00.000Z","modified":"2026-05-14T12:00:00.000Z","valid_from":"2026-05-14T12:00:00.000Z","name":"https://mask-sign-inmeta2.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mask-sign-inmeta2.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054894597826822181"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--651d1a09-016e-5c02-b323-e14b0dd03682","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://109.199.111.106:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://109.199.111.106:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--320e72b5-e8d8-5920-a2e1-83f167c4e04f","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://13.248.243.5:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://13.248.243.5:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e1469cb-ad12-503d-989e-583dfe04ecd4","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://145.223.124.65:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://145.223.124.65:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f05dd68d-9695-5cdd-8af8-282f526123e4","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://147.79.69.45:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://147.79.69.45:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--39de8752-0bf2-5888-8718-34a7178614d6","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://147.79.72.172:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://147.79.72.172:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--87b1a0cf-62d3-58c5-a331-90a3137fefad","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://147.79.72.176:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://147.79.72.176:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--871a9359-535e-5ee5-8274-b0f2f7136271","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://147.79.79.130:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://147.79.79.130:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--742627d4-61b5-5f4f-bc29-aba9e727652c","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://147.79.79.226:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://147.79.79.226:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--025a908e-d5b4-5841-9a24-2ba0c3201a62","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://148.135.128.136:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://148.135.128.136:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--18db7b24-0a02-55a1-85dc-26c3308759fa","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://148.135.128.233:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://148.135.128.233:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddc1528c-a1b4-5f49-b62a-8d3d60aaa37e","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"http://148.135.128.253:5000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://148.135.128.253:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d85398df-900b-5d70-82e0-1a8d5db4dabe","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"13.248.243.5","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '13.248.243.5']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--89c44a8a-41e4-5cf8-aede-5c51deae52eb","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"145.223.124.65","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '145.223.124.65']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e3fc05d-86d5-5b6d-b05b-c85eff8cc984","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"147.79.69.45","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.79.69.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d58fcc6-659d-5115-9ea5-46f38ecfb762","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"147.79.72.172","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.79.72.172']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0805280b-5c83-5c89-b99e-f870b3404acf","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"147.79.72.176","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.79.72.176']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--621bf5eb-bcb1-5591-9b3c-8353e1292ba3","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"147.79.79.130","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.79.79.130']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f9820a2-706f-59cf-9c27-ecd9145fe834","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"147.79.79.226","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.79.79.226']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--70cd8127-9ddd-59d5-8f21-c85a57a01e6f","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"148.135.128.136","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '148.135.128.136']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e04715d9-de0b-5a3e-b5c2-3fbe55a3ece6","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"148.135.128.233","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '148.135.128.233']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca9033c5-934c-5474-aeb2-280e4c04acd1","created":"2026-05-14T12:07:00.000Z","modified":"2026-05-14T12:07:00.000Z","valid_from":"2026-05-14T12:07:00.000Z","name":"148.135.128.253","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '148.135.128.253']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054896360445419788"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0b76be3-1d14-535e-b31a-0f26722445a2","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://178.16.53.166","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://178.16.53.166']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--98cc4016-e15c-5d0e-ad8d-76846986bdce","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://80.91.79.107","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://80.91.79.107']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ac11903-0ddc-52f0-8397-ed589f5ecb9e","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://178.16.53.166:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://178.16.53.166:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--94fd16fc-89a0-5e18-9953-79c7c1382653","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://80.91.79.107:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://80.91.79.107:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--58f9524b-b5d9-5afb-a9da-1bdab7a80bee","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"sluttiest.gay","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sluttiest.gay']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6406b7b4-6f5b-5b9c-8bd5-2a4a9cf38617","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://sluttiest.gay","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sluttiest.gay']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--30ef831f-25c2-5cb2-90cc-4426ec72c63a","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"sluttiest.space","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sluttiest.space']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ce23d2b-dd4c-56c6-a984-87436870f117","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://sluttiest.space","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sluttiest.space']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--07c05395-85f1-57a2-a44b-6eccc2b0e18f","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"mailr43-107.drs01.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mailr43-107.drs01.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f70b0b69-cb52-52c8-8d60-2e1b3144fd4d","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://mailr43-107.drs01.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mailr43-107.drs01.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e25118bf-82d5-5ebf-b609-a958df67f2af","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"ws.sluttiest.gay","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ws.sluttiest.gay']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--18750200-2971-528f-af6e-cca61168aa2c","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"http://ws.sluttiest.gay","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ws.sluttiest.gay']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bfc62c5-cc1f-5666-b4a1-d56aae721c01","created":"2026-05-14T12:59:00.000Z","modified":"2026-05-14T12:59:00.000Z","valid_from":"2026-05-14T12:59:00.000Z","name":"80.91.79.107","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '80.91.79.107']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054909554878459936"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--859f67ef-ea7f-5ca8-8e47-d815f82cfe80","created":"2026-05-14T13:09:00.000Z","modified":"2026-05-14T13:09:00.000Z","valid_from":"2026-05-14T13:09:00.000Z","name":"e-stat.b8no2fhz.shop","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.b8no2fhz.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054912040821727733"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--146bdb6f-2401-58ca-bf4f-073f68cff21d","created":"2026-05-14T13:09:00.000Z","modified":"2026-05-14T13:09:00.000Z","valid_from":"2026-05-14T13:09:00.000Z","name":"https://e-stat.b8no2fhz.shop/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.b8no2fhz.shop/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054912040821727733"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1355aec-af36-54e4-8114-03ee583c5bff","created":"2026-05-14T13:09:00.000Z","modified":"2026-05-14T13:09:00.000Z","valid_from":"2026-05-14T13:09:00.000Z","name":"login.ww2717.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.ww2717.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054912040821727733"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd2dbb41-53d2-5f46-ac5c-362e21f4a477","created":"2026-05-14T13:09:00.000Z","modified":"2026-05-14T13:09:00.000Z","valid_from":"2026-05-14T13:09:00.000Z","name":"https://login.ww2717.com/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://login.ww2717.com/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054912040821727733"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfc89197-effd-5ec7-b3a3-1d5d269b690a","created":"2026-05-14T13:16:00.000Z","modified":"2026-05-14T13:16:00.000Z","valid_from":"2026-05-14T13:16:00.000Z","name":"5a49cdedd88c0e8a1b93d4c817e91b405ddf174e261b9362ce04ef6f0ff4121e","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5a49cdedd88c0e8a1b93d4c817e91b405ddf174e261b9362ce04ef6f0ff4121e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054913864743932117"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--108637c3-0fbe-54a7-9fd3-c1092266ae2e","created":"2026-05-14T13:26:00.000Z","modified":"2026-05-14T13:26:00.000Z","valid_from":"2026-05-14T13:26:00.000Z","name":"0bf1eda8374ff2e3eb705e37eac8d65750a4d85454f535346100056399eba16f","description":"IOC reported by @GenThreatLabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0bf1eda8374ff2e3eb705e37eac8d65750a4d85454f535346100056399eba16f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/GenThreatLabs/status/2054916188765863964"}],"labels":["infostealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2402bc9-fddc-5c00-983c-dbe51ed29a7d","created":"2026-05-14T13:26:00.000Z","modified":"2026-05-14T13:26:00.000Z","valid_from":"2026-05-14T13:26:00.000Z","name":"e72ec2cbe762ca672a14a7ee660c0cab61ba020267c56f9ab8982e3be1f61a8b","description":"IOC reported by @GenThreatLabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'e72ec2cbe762ca672a14a7ee660c0cab61ba020267c56f9ab8982e3be1f61a8b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/GenThreatLabs/status/2054916188765863964"}],"labels":["infostealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80567ea6-0a47-5b6f-a685-4706f8233023","created":"2026-05-14T13:26:00.000Z","modified":"2026-05-14T13:26:00.000Z","valid_from":"2026-05-14T13:26:00.000Z","name":"58fe4ed4bc57c28b4da6b9230ff4c9d62528cdc00bba79b9f105d2a742426f4b","description":"IOC reported by @GenThreatLabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '58fe4ed4bc57c28b4da6b9230ff4c9d62528cdc00bba79b9f105d2a742426f4b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/GenThreatLabs/status/2054916188765863964"}],"labels":["infostealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c8ba2e1-eda2-5f1d-8902-433928bcb2fc","created":"2026-05-14T14:00:00.000Z","modified":"2026-05-14T14:00:00.000Z","valid_from":"2026-05-14T14:00:00.000Z","name":"zawqgvfcx.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zawqgvfcx.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054924734106595454"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--218b6e91-de9c-5508-b6b2-fd6c3ec3baa0","created":"2026-05-14T14:00:00.000Z","modified":"2026-05-14T14:00:00.000Z","valid_from":"2026-05-14T14:00:00.000Z","name":"https://zawqgvfcx.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://zawqgvfcx.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054924734106595454"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5d1d739-a070-561d-b231-98a359196b1a","created":"2026-05-14T16:00:00.000Z","modified":"2026-05-14T16:00:00.000Z","valid_from":"2026-05-14T16:00:00.000Z","name":"t-onlinehinweis.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't-onlinehinweis.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054954961486663785"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98bd79bb-e937-5a59-ab4b-737311d1c52e","created":"2026-05-14T16:00:00.000Z","modified":"2026-05-14T16:00:00.000Z","valid_from":"2026-05-14T16:00:00.000Z","name":"https://t-onlinehinweis.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://t-onlinehinweis.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054954961486663785"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b136da6-2f91-5c36-8c58-0ca5473602c0","created":"2026-05-14T16:33:00.000Z","modified":"2026-05-14T16:33:00.000Z","valid_from":"2026-05-14T16:33:00.000Z","name":"putty.org.ru","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'putty.org.ru']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054963394482974732"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--512d4d3b-9d77-5324-b9d7-ac534c0336be","created":"2026-05-14T16:33:00.000Z","modified":"2026-05-14T16:33:00.000Z","valid_from":"2026-05-14T16:33:00.000Z","name":"https://putty.org.ru/files/putty-0.73-ru-17/putty.exe","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://putty.org.ru/files/putty-0.73-ru-17/putty.exe']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054963394482974732"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cea1800b-6b4a-5662-a08c-035f4762d25e","created":"2026-05-14T16:33:00.000Z","modified":"2026-05-14T16:33:00.000Z","valid_from":"2026-05-14T16:33:00.000Z","name":"a55a560802bea130e690d55e0ea059bd8eb1657ae2cdfdafaf6e3413413fa2d6","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a55a560802bea130e690d55e0ea059bd8eb1657ae2cdfdafaf6e3413413fa2d6']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054963394482974732"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1320d726-cbba-5b04-8624-b2c71e083091","created":"2026-05-14T16:33:00.000Z","modified":"2026-05-14T16:33:00.000Z","valid_from":"2026-05-14T16:33:00.000Z","name":"b1cdd9ccc174a5b9cd9bed35bbec44d0348d0797ccffa482885685e7785e4c10","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'b1cdd9ccc174a5b9cd9bed35bbec44d0348d0797ccffa482885685e7785e4c10']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054963394482974732"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7489a56-4ea6-5b34-be8a-8c65ea283642","created":"2026-05-14T17:15:00.000Z","modified":"2026-05-14T17:15:00.000Z","valid_from":"2026-05-14T17:15:00.000Z","name":"198.37.105.175","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '198.37.105.175']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2054973788715118760"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab143eb0-7f98-5f80-83ec-f23aa77f4b37","created":"2026-05-14T17:15:00.000Z","modified":"2026-05-14T17:15:00.000Z","valid_from":"2026-05-14T17:15:00.000Z","name":"209.141.37.219","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '209.141.37.219']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2054973800098529571"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--75713d9d-7e99-58b8-9fdf-900d3303927e","created":"2026-05-14T17:37:00.000Z","modified":"2026-05-14T17:37:00.000Z","valid_from":"2026-05-14T17:37:00.000Z","name":"nyxarstealer.lol","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nyxarstealer.lol']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054979471355138223"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5ab515a-bcff-5a72-9dbc-9f069dcc68d8","created":"2026-05-14T17:37:00.000Z","modified":"2026-05-14T17:37:00.000Z","valid_from":"2026-05-14T17:37:00.000Z","name":"http://nyxarstealer.lol","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nyxarstealer.lol']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054979471355138223"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac9a8f34-cc4e-5f8e-88c7-e494399cb022","created":"2026-05-14T17:37:00.000Z","modified":"2026-05-14T17:37:00.000Z","valid_from":"2026-05-14T17:37:00.000Z","name":"scredvrsoide.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'scredvrsoide.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054979471355138223"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aedd9a23-d9af-52eb-b9cd-20990992e300","created":"2026-05-14T17:37:00.000Z","modified":"2026-05-14T17:37:00.000Z","valid_from":"2026-05-14T17:37:00.000Z","name":"http://scredvrsoide.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://scredvrsoide.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054979471355138223"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f05aa23-5dc4-537d-9606-cc76319193fb","created":"2026-05-14T17:52:00.000Z","modified":"2026-05-14T17:52:00.000Z","valid_from":"2026-05-14T17:52:00.000Z","name":"nyxar.lol","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nyxar.lol']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054983206818955340"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b707c37-f61d-522b-8fc9-ed0cdc1b9dba","created":"2026-05-14T17:52:00.000Z","modified":"2026-05-14T17:52:00.000Z","valid_from":"2026-05-14T17:52:00.000Z","name":"http://nyxar.lol","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nyxar.lol']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054983206818955340"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--193bb876-cc91-58c2-8972-6e7ecf9b6eff","created":"2026-05-14T17:52:00.000Z","modified":"2026-05-14T17:52:00.000Z","valid_from":"2026-05-14T17:52:00.000Z","name":"polnet.lol","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polnet.lol']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054983206818955340"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3af6cc1-9c81-5cf3-86ef-750f2694a42e","created":"2026-05-14T17:52:00.000Z","modified":"2026-05-14T17:52:00.000Z","valid_from":"2026-05-14T17:52:00.000Z","name":"http://polnet.lol","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polnet.lol']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054983206818955340"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bef0029-3965-54ee-b11f-9efca2fe73b5","created":"2026-05-14T18:00:00.000Z","modified":"2026-05-14T18:00:00.000Z","valid_from":"2026-05-14T18:00:00.000Z","name":"courrielweb4578.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'courrielweb4578.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054985129571803501"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb7f9097-6c3d-5fe3-add1-92a4f6b8a740","created":"2026-05-14T18:00:00.000Z","modified":"2026-05-14T18:00:00.000Z","valid_from":"2026-05-14T18:00:00.000Z","name":"https://courrielweb4578.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://courrielweb4578.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054985129571803501"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6e2af8-9401-5ab7-8665-8436dfe3cd7b","created":"2026-05-14T18:56:00.000Z","modified":"2026-05-14T18:56:00.000Z","valid_from":"2026-05-14T18:56:00.000Z","name":"130.12.182.175","description":"IOC reported by @BlinkzSec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '130.12.182.175']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/BlinkzSec/status/2054999308915679643"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5cabe78-1411-5bd4-95aa-f546c84d0846","created":"2026-05-14T18:56:00.000Z","modified":"2026-05-14T18:56:00.000Z","valid_from":"2026-05-14T18:56:00.000Z","name":"ddb25d7d4afe95a5ca96985565e5b0d14240f8d5122c20243facccc77796da9b","description":"IOC reported by @BlinkzSec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ddb25d7d4afe95a5ca96985565e5b0d14240f8d5122c20243facccc77796da9b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/BlinkzSec/status/2054999308915679643"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e74565fc-af55-514b-b1d4-e4b543c7e64e","created":"2026-05-14T19:23:00.000Z","modified":"2026-05-14T19:23:00.000Z","valid_from":"2026-05-14T19:23:00.000Z","name":"sh.azurestaticprovider.net:443","description":"IOC reported by @feross on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sh.azurestaticprovider.net:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/feross/status/2055006045077230048"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--75e47720-3e2b-56ba-b7f9-1c5b1234e66a","created":"2026-05-14T19:23:00.000Z","modified":"2026-05-14T19:23:00.000Z","valid_from":"2026-05-14T19:23:00.000Z","name":"http://sh.azurestaticprovider.net:443","description":"IOC reported by @feross on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sh.azurestaticprovider.net:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/feross/status/2055006045077230048"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ae78dcb-8a08-5c5e-8a77-3ec65155dfb0","created":"2026-05-14T19:23:00.000Z","modified":"2026-05-14T19:23:00.000Z","valid_from":"2026-05-14T19:23:00.000Z","name":"sh.azurestaticprovider.net","description":"IOC reported by @feross on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sh.azurestaticprovider.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/feross/status/2055006045077230048"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bf9b41b-2569-5034-a837-324d40ccfda1","created":"2026-05-14T19:23:00.000Z","modified":"2026-05-14T19:23:00.000Z","valid_from":"2026-05-14T19:23:00.000Z","name":"http://sh.azurestaticprovider.net","description":"IOC reported by @feross on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sh.azurestaticprovider.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/feross/status/2055006045077230048"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--304640df-633c-5b81-99a4-dcc757cb62e1","created":"2026-05-14T20:00:00.000Z","modified":"2026-05-14T20:00:00.000Z","valid_from":"2026-05-14T20:00:00.000Z","name":"hsbc.ratereset.net","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hsbc.ratereset.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055015329751765439"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e92b8b6d-55a5-5d0f-920a-b05bd0f8d330","created":"2026-05-14T20:00:00.000Z","modified":"2026-05-14T20:00:00.000Z","valid_from":"2026-05-14T20:00:00.000Z","name":"https://hsbc.ratereset.net","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hsbc.ratereset.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055015329751765439"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6131de-997e-561c-9180-7998081e5922","created":"2026-05-14T20:16:00.000Z","modified":"2026-05-14T20:16:00.000Z","valid_from":"2026-05-14T20:16:00.000Z","name":"http://156.238.242.196/linux.sh","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://156.238.242.196/linux.sh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055019561188004240"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--829bc762-a02a-5b0d-ae38-67828f694b1a","created":"2026-05-14T20:16:00.000Z","modified":"2026-05-14T20:16:00.000Z","valid_from":"2026-05-14T20:16:00.000Z","name":"176.65.139.165","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '176.65.139.165']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055019561188004240"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b04ea228-a4e9-5afe-9702-f5a96e2df9a6","created":"2026-05-14T20:16:00.000Z","modified":"2026-05-14T20:16:00.000Z","valid_from":"2026-05-14T20:16:00.000Z","name":"156.238.242.196","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '156.238.242.196']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055019561188004240"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e900f4a7-d87a-5710-91aa-2bb760d8ecf1","created":"2026-05-14T20:16:00.000Z","modified":"2026-05-14T20:16:00.000Z","valid_from":"2026-05-14T20:16:00.000Z","name":"cfc6846c015cff381e97428648603ba1","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'cfc6846c015cff381e97428648603ba1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055019561188004240"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--24a698ab-1f65-5b98-9f29-e8dded6e31e6","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"celsius.network-claimsportals-access.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'celsius.network-claimsportals-access.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--425b7f39-5de3-5775-8612-acc25939d0d1","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://celsius.network-claimsportals-access.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://celsius.network-claimsportals-access.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--011338c6-bed8-5fb2-b2b5-c9f2c4b5ef6b","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"network.distribution-portal-creditor.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'network.distribution-portal-creditor.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a12b823-eeff-5e05-8436-aebc1f8f5df2","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://network.distribution-portal-creditor.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://network.distribution-portal-creditor.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e043f189-c4f4-5ec5-86ba-8e0405c130d9","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"celsius.claimsportal-services-updates.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'celsius.claimsportal-services-updates.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c06c048-def0-5c6e-a10a-0374a719db4b","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://celsius.claimsportal-services-updates.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://celsius.claimsportal-services-updates.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78ff0327-4f44-5dc7-98e9-f8fa5db8af68","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"celsius.network.distribution-portal-creditor.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'celsius.network.distribution-portal-creditor.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2779de7-af3b-573a-9928-305003035cbc","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://celsius.network.distribution-portal-creditor.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://celsius.network.distribution-portal-creditor.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd0dc266-3f77-5d34-a341-8b613f2f8d95","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"claimsportal.celsius.network.distribution-portal-creditor.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'claimsportal.celsius.network.distribution-portal-creditor.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32d01888-52a3-5c2a-9299-6fa77eca5175","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://claimsportal.celsius.network.distribution-portal-creditor.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://claimsportal.celsius.network.distribution-portal-creditor.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95e0933f-1dee-56f2-a2c5-ce9ced298c0f","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"login.brevo-access.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.brevo-access.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--450f1f71-d4bc-50e5-b6a4-a95857de47c7","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://login.brevo-access.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.brevo-access.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c1c693e-e0a2-51fd-839a-f961d81a7ebf","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"apps-brevo.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'apps-brevo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--308d3224-66f1-5061-bb30-75e6fb3ca9d5","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://apps-brevo.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://apps-brevo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f23d4402-90df-5dc3-adf4-bdf526e97e66","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"claimsportal.celsius.network.distribution-portal-creditors.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'claimsportal.celsius.network.distribution-portal-creditors.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--809e9571-5362-57f1-8282-0e56a351702f","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://claimsportal.celsius.network.distribution-portal-creditors.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://claimsportal.celsius.network.distribution-portal-creditors.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e805a542-165b-5252-95d0-da26482028b4","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"celsius.claimsportal-distributions-services.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'celsius.claimsportal-distributions-services.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03dba8d5-b608-5e33-b309-409b11f47beb","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://celsius.claimsportal-distributions-services.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://celsius.claimsportal-distributions-services.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0464625-3383-591e-ab5b-6de44d0848d3","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"network.distribution-portal-creditors.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'network.distribution-portal-creditors.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df51df76-2d86-5a91-8993-61c4aa8de0ab","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://network.distribution-portal-creditors.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://network.distribution-portal-creditors.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0068275f-cb23-5220-876b-518e84fe0e10","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"claimsportal-distributions-creditors-id233285.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'claimsportal-distributions-creditors-id233285.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--786c4830-b4b3-5bbb-8ecc-d94915e0b5b0","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://claimsportal-distributions-creditors-id233285.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://claimsportal-distributions-creditors-id233285.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ac638f1-8ea1-58d2-934c-03030bdc9bcd","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"celsius.network.distribution-portal-creditors.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'celsius.network.distribution-portal-creditors.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15b29a56-b2fe-5c2e-a88c-77e9b49b2ac4","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://celsius.network.distribution-portal-creditors.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://celsius.network.distribution-portal-creditors.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f1fcb7e-1527-5108-bdcc-9b8d9e7e1e4b","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"45-151-106-104.plesk.page","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '45-151-106-104.plesk.page']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaac1629-e79e-5628-87db-0a40e52b12a5","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://45-151-106-104.plesk.page","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45-151-106-104.plesk.page']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e750e117-5406-52e4-9bf2-e66e74d70339","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"eager-brahmagupta.45-151-106-104.plesk.page","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eager-brahmagupta.45-151-106-104.plesk.page']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a08509c3-1e29-576d-bc20-0dc00416d9d4","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://eager-brahmagupta.45-151-106-104.plesk.page","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eager-brahmagupta.45-151-106-104.plesk.page']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c1dc3f7-8da9-5369-8f9d-cba0ee68771d","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"http://45.151.106.104","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45.151.106.104']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc376383-5115-57d9-b722-84417113cac7","created":"2026-05-14T20:41:00.000Z","modified":"2026-05-14T20:41:00.000Z","valid_from":"2026-05-14T20:41:00.000Z","name":"45.151.106.104","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.151.106.104']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055025832603578767"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b6c961c-dfcb-5aaf-9d95-79269bd74bd1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"thuide.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'thuide.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3188997-0320-525e-8131-349dc550e99b","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://thuide.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://thuide.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd43336a-1681-584f-9132-29de924e32b4","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nid.thuide.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.thuide.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30890966-e58e-5ca0-a407-98853f414ce4","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nid.thuide.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.thuide.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d37cf6e0-4579-5868-93e3-1d464b60e512","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ninvoice.i2fh7k.sqpo7udsee0.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninvoice.i2fh7k.sqpo7udsee0.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--458b693b-e68b-512d-88dc-bba52c92e7c8","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ninvoice.i2fh7k.sqpo7udsee0.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninvoice.i2fh7k.sqpo7udsee0.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dde36833-1c56-518c-a844-34a0a86b2138","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"docsupport.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docsupport.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc2fbed6-b6c6-5de0-abff-e2f86b09f720","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://docsupport.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docsupport.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1f94fdd-e451-5a4c-9edc-696c7e8ee063","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ndoc.nusrtx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc.nusrtx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b6c4cfc-6e0c-5e9e-9d84-565cc4eb389c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ndoc.nusrtx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc.nusrtx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cd8165d-f26c-5acc-a1b4-d85cdcd9f025","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ninvoice.noiduser.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninvoice.noiduser.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c3389cb-1d06-52d9-845c-01d35f5cd449","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ninvoice.noiduser.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninvoice.noiduser.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5d70d39-6036-5d65-b443-432bd4bcac71","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"noiduser.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'noiduser.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cde370d0-9a1a-5013-bc5d-610d431d5ce0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://noiduser.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://noiduser.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a960374-8ceb-59d3-a6d8-44da90da7a2b","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nid.nusrtx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nusrtx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d007d5b-f6aa-53a4-a720-3ead067800df","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nid.nusrtx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nusrtx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41dbd08a-eecb-518c-affc-3d2872b8440c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nverdoc.979b9n.r55jmmvgp3s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nverdoc.979b9n.r55jmmvgp3s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d104a01d-6205-509b-993d-562167f8eb9a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nverdoc.979b9n.r55jmmvgp3s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nverdoc.979b9n.r55jmmvgp3s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bc324ec-411c-53b9-ba75-ad6ada304ea0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"txproblem.1d0h72.777vfumk8a0.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'txproblem.1d0h72.777vfumk8a0.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c7089fa-2841-5328-890b-ac2df71ff675","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://txproblem.1d0h72.777vfumk8a0.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://txproblem.1d0h72.777vfumk8a0.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5112f6f-c509-5876-95e7-17810f17e549","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ndocnver.8dj4dr.covbq4shvb5.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocnver.8dj4dr.covbq4shvb5.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9f5242d-7718-561c-a6fa-375b2eace90c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ndocnver.8dj4dr.covbq4shvb5.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocnver.8dj4dr.covbq4shvb5.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af6d5086-6ae0-543d-bc6d-5a7cb01ef7cb","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ndocnver.3u5x5.6tip2gtb4f1.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocnver.3u5x5.6tip2gtb4f1.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bed65854-b268-5af8-98b9-73184468d871","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ndocnver.3u5x5.6tip2gtb4f1.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocnver.3u5x5.6tip2gtb4f1.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8422b633-6c1d-5c13-9446-52f772bc0b03","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nverdoc.2ermxe.th7s18w5abl.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nverdoc.2ermxe.th7s18w5abl.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba24a629-eb63-5ab2-a5fc-3480ad8d9239","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nverdoc.2ermxe.th7s18w5abl.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nverdoc.2ermxe.th7s18w5abl.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--963b39f1-a856-5f63-9cf6-a4ef8dcf7853","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"55t2vtuhx2.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '55t2vtuhx2.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--053070e9-ac17-57e6-a940-d057182f3c38","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://55t2vtuhx2.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://55t2vtuhx2.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53bfe4f3-f754-5969-bb4c-86e730e1da2e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"0s2snxin4t.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '0s2snxin4t.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68a5147a-9737-5e8b-b2a9-62714da1b19e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://0s2snxin4t.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://0s2snxin4t.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58990472-5891-56b2-8678-b76183a04ac0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ugogqmfezq.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ugogqmfezq.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ef40026-8ff6-575c-8efb-1068e9f4584e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ugogqmfezq.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ugogqmfezq.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d995ecdc-7b4d-51df-8d1a-f718f5380fdc","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"mareqsutxn.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mareqsutxn.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b84150f0-6631-5fbf-bfbf-1f646cbb7fbd","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://mareqsutxn.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mareqsutxn.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b76300b-20b5-5eb2-b809-cd64d73f787c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"aai1khooe8.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aai1khooe8.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0a76bae-724e-52d8-a257-d2f35e4f933c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://aai1khooe8.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://aai1khooe8.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abdc9e1c-a30f-532c-a2ee-d39482fef79b","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"rfywn135de.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rfywn135de.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b98e4b6-cf3f-501e-962e-5d5cd57bd18a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://rfywn135de.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rfywn135de.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85bf0b25-74c7-5711-9fbb-65098f07b321","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"mw8vszy21b.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mw8vszy21b.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f451740-1602-537b-91f0-75eafdf1c167","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://mw8vszy21b.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mw8vszy21b.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70de8b20-0bc8-5825-adcb-28c5a3817e3f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ktvw0gpwhq.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ktvw0gpwhq.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5021b84f-3699-53c5-a9da-e5ec15825e4a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ktvw0gpwhq.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ktvw0gpwhq.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--479b33ac-0e75-5de8-9b61-5e697cc581a7","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nid-opiohy.4gog2.rfywn135de.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-opiohy.4gog2.rfywn135de.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8716813d-984c-5fe1-8901-dd4de99f9598","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nid-opiohy.4gog2.rfywn135de.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-opiohy.4gog2.rfywn135de.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b8938ff-06ec-5255-9242-706fc771a12d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"32r2lfkhyf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '32r2lfkhyf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34fe15b0-b6db-504a-8986-c1032bdd3ea7","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://32r2lfkhyf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://32r2lfkhyf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76e2bfa0-263c-538d-b7b7-143b3303c2cb","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"12e9w4hp1f.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '12e9w4hp1f.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abca7759-8516-5376-a83c-0576c153931f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://12e9w4hp1f.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://12e9w4hp1f.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f810010-eceb-5309-b289-91339c9114a1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"z8jreih14d.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'z8jreih14d.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bab49f1-1871-56c7-9f75-11550b02bfc5","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://z8jreih14d.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://z8jreih14d.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb0beef2-7bde-5459-891a-7b95934fe5a2","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"or393dt7k0.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'or393dt7k0.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81a6062c-8bff-5f7d-84b3-ba2c69a06e72","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://or393dt7k0.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://or393dt7k0.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffd7a351-404d-53b3-81eb-dff13ef068b2","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"9ysj9j3toq.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '9ysj9j3toq.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fc59477-297a-5eeb-afd5-1ec8fd217d5a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://9ysj9j3toq.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://9ysj9j3toq.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b94e1922-b38c-5669-98bc-032c49c41cc7","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"dwcri4wrof.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dwcri4wrof.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a7055bf-f124-539d-96a2-95935106ceb3","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://dwcri4wrof.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dwcri4wrof.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d72cd677-1125-532d-a5be-739f5c729dd1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"t71oxe7g8r.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't71oxe7g8r.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e6cca82-e015-53a4-94ab-36f86f57b216","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://t71oxe7g8r.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t71oxe7g8r.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a9936a4-1af0-5d98-9441-9f9a90db531f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"sgv5lblons.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sgv5lblons.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae3994ec-63aa-5c07-92d0-6d35db4ebb06","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://sgv5lblons.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sgv5lblons.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d31e2878-8ddf-5311-a6a6-0483e9690577","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"y8eserofr9.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y8eserofr9.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcb165c9-538a-5250-b39f-ff5726b1ba40","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://y8eserofr9.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y8eserofr9.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--414fd53c-96ac-5f73-ac31-3e49c9f7998f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"kufgi5a66x.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kufgi5a66x.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06643b52-80fa-5de7-a99f-d8f963685580","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://kufgi5a66x.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kufgi5a66x.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4da1ba39-ba03-5730-ae50-6b73c4e278b8","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"7jqzrt3nvn.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '7jqzrt3nvn.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09934beb-a015-5bc8-85c4-cbe193d473c6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://7jqzrt3nvn.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://7jqzrt3nvn.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98d9a4d1-895b-572e-b360-27c6eb49ca9b","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"hgx3c2aynw.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hgx3c2aynw.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7612debd-af2f-5af4-a2e0-15ac32a1239c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://hgx3c2aynw.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hgx3c2aynw.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab53d455-6100-54d1-baef-2579cd043cab","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ufood.ddnsguru.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ufood.ddnsguru.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d000aebf-cd8c-59ed-8b68-7393582e137b","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ufood.ddnsguru.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ufood.ddnsguru.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61f17465-bc6a-51cf-890f-930998627d34","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"npooo.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npooo.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a55d5745-0657-50f3-80e5-f6e8af000756","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://npooo.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npooo.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f14e26c6-d8ed-5e0d-8b79-07810086fee7","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"tgide.xubi.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tgide.xubi.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e9dbaa5-018c-5463-9b8b-e310e2d2051e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://tgide.xubi.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tgide.xubi.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e07500ef-218f-5519-af73-8cf47e0fc856","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"tlogn.ddnsgeek.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tlogn.ddnsgeek.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f590416-eed3-5787-bf23-1516ca58e016","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://tlogn.ddnsgeek.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tlogn.ddnsgeek.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f81cfc57-594b-5fdc-91eb-7e160b39c25c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nugge.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nugge.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5619fa47-7656-561d-9ed0-1e6fd5d51ef2","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nugge.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nugge.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4c6c557-ab68-5da5-8d50-6fd751de1fe0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"mois-doc.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois-doc.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78594da5-707c-5819-8541-6a99cf75c411","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://mois-doc.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois-doc.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10317d1c-7f81-58f1-b087-fb67721d3ea7","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ips-work.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-work.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--feff086f-00a9-5a79-97ed-78618058b871","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ips-work.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-work.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a90a3b1-8e2a-54ef-8c11-0365e9f1eef5","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"tax-search.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tax-search.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a5ca80e-b013-5250-b770-ad78d187a293","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://tax-search.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tax-search.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d9652fb-be27-5ab8-96ac-daf6350bfc5f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"po-doc.gm8n.ehr8afl0mf.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'po-doc.gm8n.ehr8afl0mf.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a243450b-1d91-517a-ac1e-39f44283b826","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://po-doc.gm8n.ehr8afl0mf.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://po-doc.gm8n.ehr8afl0mf.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--962f5891-7014-51ac-9424-4ba2cf9181a8","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"robyritrl0.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'robyritrl0.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4d84f1c-65fb-5944-a88c-1934bd91505a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://robyritrl0.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://robyritrl0.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab6187a7-af56-5b1c-9da6-3b19f8cdca34","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ehr8afl0mf.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ehr8afl0mf.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34606791-88d9-57cf-b93c-753fe2b17ec8","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ehr8afl0mf.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ehr8afl0mf.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76cecd3e-52e2-5f5d-b947-d68d0d1d52f6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"guidevline.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'guidevline.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a12e545c-e7dc-53df-8c81-4bdfd5dd4384","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://guidevline.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://guidevline.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--520b535e-c1da-55be-b9d0-3b2f1454eaba","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"y9mq7t3h11.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y9mq7t3h11.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--011bf603-1f5c-5f2e-a3c7-1333a3336691","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://y9mq7t3h11.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y9mq7t3h11.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abb4bc51-cbb7-5eef-aab5-4cfcd88ace7f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ab761b9sni.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ab761b9sni.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39f840dc-8295-50da-b110-b06455ed04b1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ab761b9sni.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ab761b9sni.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b51ac7a2-0132-5616-a2cd-75ed32155c72","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"d0ft3sxfx3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'd0ft3sxfx3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac947f85-eef3-5e01-801d-d2519be59e5d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://d0ft3sxfx3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://d0ft3sxfx3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0e0ab7e-1d5d-5bd8-978b-3bc31b6bc047","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"azwihailbl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'azwihailbl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6d46e4c-eb9b-52f9-8c1a-8f5bda1fc233","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://azwihailbl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://azwihailbl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--264368fa-4bd2-5eb1-a86e-2cf2db680742","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nndq.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nndq.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfef91c4-6b2e-5e61-bd99-b8282d86e49e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nndq.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nndq.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f87fe129-a284-595d-9b46-69b998badd85","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"s7rc7llnw9.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 's7rc7llnw9.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6de0188-5f4b-54f0-95fe-5b8a1146efbb","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://s7rc7llnw9.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://s7rc7llnw9.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaaf4123-7f8a-5745-ad1b-003153aca244","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"42yqeg15z7.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '42yqeg15z7.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a67da393-9a99-54a7-a5d6-86c58239f236","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://42yqeg15z7.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://42yqeg15z7.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bcae24e-f77e-5b8d-b667-d16ee183bc9f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"31mz639cjr.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '31mz639cjr.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f139af3f-3cbc-50ea-98fd-515c4db9c91d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://31mz639cjr.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://31mz639cjr.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbf68f7b-c83c-5779-8618-b3ca2f948011","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nidlog.scheculetx.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlog.scheculetx.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41c70fba-78bd-5aa0-a30a-abc32fafb6a3","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nidlog.scheculetx.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlog.scheculetx.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b306d9aa-8f63-5a61-9b22-6942a4073d2c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nid-tax.dynuddns.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-tax.dynuddns.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddb3185e-c36e-5660-956c-054007986570","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nid-tax.dynuddns.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-tax.dynuddns.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70ae8ead-c926-56d2-9ffb-2149eafa8618","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"scheculetx.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'scheculetx.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a06e6fd1-3bf0-5eba-9fa0-effa57bb64a6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://scheculetx.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://scheculetx.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01630443-a80c-56b9-a883-573bbcbd039a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ssl-connect.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ssl-connect.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44db832a-b32b-5e9c-80ef-cd791f0aa72a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ssl-connect.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ssl-connect.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12fcc609-671d-59e2-bed5-c50e26af1255","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pc3wnc0sb5.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pc3wnc0sb5.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cc1c7c7-7d15-5f04-9d00-9af522d96a15","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pc3wnc0sb5.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pc3wnc0sb5.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1272cd5-ce65-56d2-b4cf-9eea5ab778c7","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ndoc.ssl-connect.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc.ssl-connect.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af16fa7c-a27f-5d99-b9da-06751075ff19","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ndoc.ssl-connect.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc.ssl-connect.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--568368b4-fd06-5b66-a191-dd1096757469","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"dns.ssl-connect.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dns.ssl-connect.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d568405-dd7f-5c5a-be7d-0c4ffa37c709","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://dns.ssl-connect.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dns.ssl-connect.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd7973b7-d4af-5a3e-8ee4-0fa2ef2f916d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nstk.nid-tax.dynuddns.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nstk.nid-tax.dynuddns.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b5b396e-4789-528b-8eea-328a1cf46a8f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nstk.nid-tax.dynuddns.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nstk.nid-tax.dynuddns.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22a5bf9b-e4e4-51fe-9a2e-8178fa984e0e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pnosw.loseyourip.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pnosw.loseyourip.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c86303a-1201-5df9-9936-c69fcda29219","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pnosw.loseyourip.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pnosw.loseyourip.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afb31821-6cc0-5289-b228-b25babcde3de","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"po-doc.95mqw.42yqeg15z7.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'po-doc.95mqw.42yqeg15z7.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59d2be66-d717-5197-9264-8ca857866aa6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://po-doc.95mqw.42yqeg15z7.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://po-doc.95mqw.42yqeg15z7.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c91fac1-bf61-5c2e-9039-2718f37d206f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ndoc.pnosw.loseyourip.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc.pnosw.loseyourip.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e762ac4-1e01-54c6-8171-5b20324d2f12","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ndoc.pnosw.loseyourip.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc.pnosw.loseyourip.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--064f7012-f127-520b-b1ab-2b36eae2438e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"cha5vp65tc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cha5vp65tc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--295ba4e3-496e-53e9-8daa-24b5e6324e0a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://cha5vp65tc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cha5vp65tc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11cbc8d2-afd6-5d35-8064-37e0cf1354b3","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"4zjg6ezmr1.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4zjg6ezmr1.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22c3aa31-6e3a-5c60-93d7-a881582ad88f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://4zjg6ezmr1.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4zjg6ezmr1.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--319c2fd5-c7f8-5440-bbcd-87d0dcf02815","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pload.accesscam.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pload.accesscam.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--906007ee-30ae-53d5-861c-c05bcd535ddf","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pload.accesscam.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pload.accesscam.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08a42bc4-2c88-583a-9741-368f512ddc79","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"php-config.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'php-config.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d87bf1ff-dbae-55b2-a2c0-36f46a70f7fb","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://php-config.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://php-config.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a09f6ee9-6631-514e-a405-2e73edc24917","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nnztcxy6uc.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nnztcxy6uc.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41e17f28-62fa-5b15-87ea-3375fd9b1f1c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nnztcxy6uc.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nnztcxy6uc.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5c7b480-b2cf-5070-ba38-a46078214976","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"dns.php-config.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dns.php-config.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a1fd6dc-5e47-571f-8066-aa1d40a7e6bb","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://dns.php-config.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dns.php-config.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6571ff92-a78f-5782-bf7d-0cb219784691","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"swat-check.ezgateway.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'swat-check.ezgateway.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49c4bd91-48bb-5331-aca5-36dabf8e25c1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://swat-check.ezgateway.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://swat-check.ezgateway.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39a05cc7-644e-5968-9b47-be12f9d20e35","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"doc-suggest.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc-suggest.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aec982c-6d4a-5b25-b1e2-e5d028e3ad9a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://doc-suggest.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc-suggest.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc710e6f-47e0-5ec8-a624-3c63488b0992","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pdoc-load-77.doc-suggest.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pdoc-load-77.doc-suggest.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ff9f44f-c6a9-5f94-be23-4d9057f8e77a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pdoc-load-77.doc-suggest.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pdoc-load-77.doc-suggest.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84ff921a-a495-51bf-9671-398054b5433e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"1zankmyc0d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '1zankmyc0d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03544b78-617e-5a2c-9524-a3dcaaeba0fa","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://1zankmyc0d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://1zankmyc0d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29236661-0fcb-576b-9993-2ce8bd4d42be","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"k6d1cwxcvc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k6d1cwxcvc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b810aa40-98f4-5a5b-9afb-d739c2904ca6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://k6d1cwxcvc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k6d1cwxcvc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf044135-f924-51de-8969-bc07b47dca4c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"po-doc.2rk6.nnztcxy6uc.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'po-doc.2rk6.nnztcxy6uc.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d2c19ca-4840-50f0-ae68-138d1b612226","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://po-doc.2rk6.nnztcxy6uc.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://po-doc.2rk6.nnztcxy6uc.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ef8346b-30d2-5847-a42d-2f3cf16406b3","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"0751u9n4lg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '0751u9n4lg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e619d849-1821-5033-bea2-580bc742475e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://0751u9n4lg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://0751u9n4lg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--563b8387-34ed-51e3-b9db-0037917979a4","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"v5uol9d3ld.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v5uol9d3ld.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04fa1344-e5e1-502f-b992-bc5814885212","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://v5uol9d3ld.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v5uol9d3ld.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1417402c-c749-5032-994c-3b9b9d0ee5c0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"go-kr-doc.idmbz.1zankmyc0d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'go-kr-doc.idmbz.1zankmyc0d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef0444f8-939c-58e5-86e7-b64c18775322","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://go-kr-doc.idmbz.1zankmyc0d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://go-kr-doc.idmbz.1zankmyc0d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4305acf3-f089-56a7-8c0d-b056bde0c9c9","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"8ayvym1fak.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '8ayvym1fak.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77ca521b-9f5b-5722-afc9-d6f748bffc1d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://8ayvym1fak.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://8ayvym1fak.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9713ce7-3787-5cf6-bcf4-3fd4692ac58e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nid-policy.mviw0y.2e2yvueuot.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-policy.mviw0y.2e2yvueuot.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--788dea48-61f9-5ff5-a277-0a404f53d08c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nid-policy.mviw0y.2e2yvueuot.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-policy.mviw0y.2e2yvueuot.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1e138d3-66d9-5e1f-977f-1ef6f1dd5a54","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nid-policy.7nj9.yc4yfcbhap.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-policy.7nj9.yc4yfcbhap.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5409a9a6-19bf-585b-984b-828c587d2670","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nid-policy.7nj9.yc4yfcbhap.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-policy.7nj9.yc4yfcbhap.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9f45517-c782-5ba0-8f48-a1734e7538ff","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"yc4yfcbhap.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'yc4yfcbhap.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b71aa45f-5466-5008-9230-db3d8787203e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://yc4yfcbhap.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://yc4yfcbhap.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c44bf1f8-f5b5-569b-b907-a7eba20990fa","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ndoc-nid.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc-nid.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67260be3-7dc2-57a0-9eb1-53df285312af","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ndoc-nid.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc-nid.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d71748cd-379e-560b-9d88-63c80c472915","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pol-nav-puz.ndoc-nid.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pol-nav-puz.ndoc-nid.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7280d85a-4bb9-572b-bf37-2b7ad308149b","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pol-nav-puz.ndoc-nid.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pol-nav-puz.ndoc-nid.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e36f071d-f2b2-51fb-a004-d7cf89044b59","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pol-nav-joi.pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pol-nav-joi.pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c692da43-543b-5cf8-82a7-5d7176abde22","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pol-nav-joi.pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pol-nav-joi.pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b77e7ec-1ff3-5f62-9f0d-4ff9112124b0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pol-nav-kov.pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pol-nav-kov.pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2a0870b-0b8c-5f34-a783-82b3f40ebf18","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pol-nav-kov.pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pol-nav-kov.pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da58ef02-e825-5ab0-86e1-1e4fe6a0c959","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"passkey-info.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'passkey-info.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e38a87e3-cd8f-5fc8-aaab-ed28c4f94ae9","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://passkey-info.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://passkey-info.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cced2c5d-cd8d-5448-b923-2c982a92bf94","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52a4c5ea-53c4-5ada-9b50-315a3f91a6a3","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22dd1627-a8d5-5f0a-99ac-a99081fd8964","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"invoicecheck-jqk.pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoicecheck-jqk.pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bf07183-4bc0-5da6-ba5e-4f6f755e90c6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://invoicecheck-jqk.pont-vner.mydns.vc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoicecheck-jqk.pont-vner.mydns.vc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e629898-1fc6-5df9-88a2-a7d83e60eaa0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"conifir-mx.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'conifir-mx.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72cb9f36-ff2f-599d-8696-652729793ec9","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://conifir-mx.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://conifir-mx.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faa1e2e2-0706-5d4e-b76d-f41cf8d39a40","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"mtoken.nugge.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mtoken.nugge.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d1d96db-f9ce-5999-844c-385f7ab1d3f3","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://mtoken.nugge.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mtoken.nugge.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1e410da-2db2-558d-8b69-35929fb2bbbc","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"user-doc.ips-work.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'user-doc.ips-work.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d461abaa-f007-5554-87e8-741e291267c9","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://user-doc.ips-work.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://user-doc.ips-work.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a30273c-2d2b-5934-8978-5ef756e34057","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nv-token.crabdance.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nv-token.crabdance.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07637db8-6330-56ee-9d58-ffa778c078d5","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nv-token.crabdance.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nv-token.crabdance.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e69dd67e-787b-5253-9a2a-248a81dd1587","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"urgtte.naver.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'urgtte.naver.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f2fb7f1-ac69-5174-8666-1916dbe508c4","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://urgtte.naver.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://urgtte.naver.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08167b77-d799-5ac6-a588-fdd5af989ab1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"booking-doc.gd8d.92ssiovzua.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'booking-doc.gd8d.92ssiovzua.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71978c85-fb23-593e-a88f-c3b859b7c643","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://booking-doc.gd8d.92ssiovzua.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://booking-doc.gd8d.92ssiovzua.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--278b8cbf-dd78-5a1f-8dc4-cb4b9c102d4d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"92ssiovzua.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '92ssiovzua.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a223dda-1883-5bea-a2f6-f2815f6af229","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://92ssiovzua.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://92ssiovzua.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f67ffd1-a219-5c2e-9f71-3c16b9ffa271","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"cti.nts-go.ips-auth-user.n-e.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cti.nts-go.ips-auth-user.n-e.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--693c73bd-748e-53ce-93ed-b27889d2709e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://cti.nts-go.ips-auth-user.n-e.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cti.nts-go.ips-auth-user.n-e.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--945aa5e0-59cd-52e8-a53d-ba4bb3857de1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"cbgx8hfgym.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cbgx8hfgym.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b70cd33-2510-5e65-ad71-f4b45a15498e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://cbgx8hfgym.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cbgx8hfgym.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d9cebf3-3650-5f71-83de-c09241ce13a1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nid-auth.petfoodkorea.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-auth.petfoodkorea.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e7521e9-67fb-57c5-9a9d-4cb44af2b9f0","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nid-auth.petfoodkorea.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-auth.petfoodkorea.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14a8de18-b741-54ff-8784-e7e5f4e72750","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"baqcf4rz7n.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'baqcf4rz7n.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5339738-3d19-59dd-b6eb-e1f7e810f926","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://baqcf4rz7n.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://baqcf4rz7n.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab810079-5cce-5ae5-9ff8-8a077ec6b36d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"l94i8b2wi8.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'l94i8b2wi8.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ca7efda-9aaa-5789-9ea8-80050d953c76","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://l94i8b2wi8.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://l94i8b2wi8.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--863a1658-5297-59fc-8465-5e2e75c16748","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"59v067xp0k.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '59v067xp0k.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0536b499-056b-5567-a009-2d0f3bb2bcef","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://59v067xp0k.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://59v067xp0k.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89fc2f8b-f4fa-5387-936a-c76e1a3d8762","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ysxvh5w2yn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ysxvh5w2yn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48b4e159-13a4-53dc-b95b-4d259e820646","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ysxvh5w2yn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ysxvh5w2yn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6878635-3fff-5cba-9789-3094f9c624bd","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"me6rc5j08q.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'me6rc5j08q.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8115a484-e855-58bf-9344-7830bb544fa2","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://me6rc5j08q.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://me6rc5j08q.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cde1d681-e9e3-5710-8e8d-85f1b073209e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"gng9kybi9k.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gng9kybi9k.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--745a9942-0fee-5676-b14d-63d2f25394b5","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://gng9kybi9k.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gng9kybi9k.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c024258a-f261-523c-a268-ec5101c2502c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"y05jqzxey7.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y05jqzxey7.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--881746ed-fe9b-5f35-859b-c4e35b83a740","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://y05jqzxey7.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y05jqzxey7.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43917427-03d6-5a6b-83e2-56628b1b3908","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"j4m2q9x0xg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j4m2q9x0xg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--723c9d68-476d-52c7-909d-58a4dc5b6e00","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://j4m2q9x0xg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j4m2q9x0xg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a7f2efa-7d5c-53a3-abc3-cf782af302b5","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pm2djbx5ne.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pm2djbx5ne.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34e1d76b-9b69-5ecd-ad2a-888d2606ef59","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pm2djbx5ne.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pm2djbx5ne.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41b2e429-67ee-5072-8113-4dce61b408b2","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"law-doc-alert.zxxz0k.fdf51nswgh.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'law-doc-alert.zxxz0k.fdf51nswgh.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c639c0e0-97a0-50c9-a510-013df0d9c0f6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://law-doc-alert.zxxz0k.fdf51nswgh.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://law-doc-alert.zxxz0k.fdf51nswgh.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4790bcc9-f9c8-583e-a810-1218b4b19527","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.17ej3.t1wcwln96d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.17ej3.t1wcwln96d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96924e9c-adf0-57bf-bc56-3b70c59b5e81","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.17ej3.t1wcwln96d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.17ej3.t1wcwln96d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceea640d-2742-5d06-a4c8-c7d269b2f82e","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.iu3zd.j4m2q9x0xg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.iu3zd.j4m2q9x0xg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13ce0ade-7ea7-56c9-9024-5cbf05aa2068","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.iu3zd.j4m2q9x0xg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.iu3zd.j4m2q9x0xg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c239df2e-3b57-5b70-a81e-51e27d8369f4","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.v6f1.cogu4qno4o.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.v6f1.cogu4qno4o.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f22177f-051d-5a2e-922a-65ae6167d8da","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.v6f1.cogu4qno4o.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.v6f1.cogu4qno4o.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b511c0d9-21c8-53f6-9d8f-148f8ebb3431","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.c9ip.thu8cl13up.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.c9ip.thu8cl13up.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e11d772c-91f8-5260-8406-208e5579e06c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.c9ip.thu8cl13up.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.c9ip.thu8cl13up.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94811b96-b74c-5b02-8699-8a9165e30fb6","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.mlc9l.t1wcwln96d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.mlc9l.t1wcwln96d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--478d3961-22fe-513f-b6ee-b438de5974fb","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.mlc9l.t1wcwln96d.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.mlc9l.t1wcwln96d.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15f0ba02-20ce-5fa0-82d1-a31b49e75593","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.5b77w.l94i8b2wi8.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.5b77w.l94i8b2wi8.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf340842-40ca-5855-b6be-186ea99df661","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.5b77w.l94i8b2wi8.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.5b77w.l94i8b2wi8.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a94f2c6e-89fd-5f16-a2f8-8bd3e89d90eb","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"ips-doc-auth.xvn58.ip67ig0ffq.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-doc-auth.xvn58.ip67ig0ffq.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2000c6e9-a417-57d7-93a8-8e34d36346c5","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://ips-doc-auth.xvn58.ip67ig0ffq.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-doc-auth.xvn58.ip67ig0ffq.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0904de1c-82e8-528f-87c6-fae3d4b42d40","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.9t82.y7sxucb2iv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.9t82.y7sxucb2iv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47f08e78-766d-53a3-a936-7b6c909115bc","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.9t82.y7sxucb2iv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.9t82.y7sxucb2iv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aa49af0-a64b-5508-add7-df38c7ab36ce","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"vitheq17yl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vitheq17yl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82590963-36a7-5af8-9bc7-2fc29689dfa9","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://vitheq17yl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://vitheq17yl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86daa210-1d22-5b25-b028-54a0ce538dfd","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"global-works.2974pm.thu8cl13up.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global-works.2974pm.thu8cl13up.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06e0d748-fdac-59a9-a98c-664bef4c7bba","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://global-works.2974pm.thu8cl13up.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global-works.2974pm.thu8cl13up.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--799aaf8d-970d-5e70-8cc6-ad7b406487c8","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pufyw1fgwq.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pufyw1fgwq.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b8904f8-12b1-5f3b-b00e-a282ad36eea3","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pufyw1fgwq.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pufyw1fgwq.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c6e10af-a46e-5995-aab6-708214bd4b96","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"pxkq0mjbe6.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pxkq0mjbe6.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--893d506c-31be-538d-863f-007ad8855ce8","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://pxkq0mjbe6.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pxkq0mjbe6.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26245ee2-64d8-5fd3-a5f7-99e093e11471","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"kgbi5cd292.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kgbi5cd292.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c63ef0f6-7e63-52be-9b8d-aea886053c64","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://kgbi5cd292.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kgbi5cd292.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--481cd449-dc60-5914-90f8-ef3cd2b353c2","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"mp1bchmkf3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mp1bchmkf3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06bf2c8c-e0ac-52d9-9433-aed00ae22bb1","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://mp1bchmkf3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mp1bchmkf3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb581bf4-f979-5330-9c62-19b5fc346793","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nv-check-log.v1jbv.mp1bchmkf3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nv-check-log.v1jbv.mp1bchmkf3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc792374-0613-59f9-8a3f-d51b83d43412","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nv-check-log.v1jbv.mp1bchmkf3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nv-check-log.v1jbv.mp1bchmkf3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b383886-a455-50ef-8e37-947e255ac359","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"gbouy8fn5i.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gbouy8fn5i.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef4ca347-af46-59b8-9321-cbf9261b9354","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://gbouy8fn5i.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gbouy8fn5i.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8682073-b7cb-56e8-b99c-b0abbd54f13c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"nts-doc-auth.x82ad.cfqcn6txfo.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts-doc-auth.x82ad.cfqcn6txfo.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4749b855-f96d-5d43-ae1c-a07ee791496d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://nts-doc-auth.x82ad.cfqcn6txfo.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts-doc-auth.x82ad.cfqcn6txfo.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61433277-63e9-5cb3-a35e-0f12b4b84fd8","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"znn4zk2xc3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'znn4zk2xc3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ab0f56d-0007-5f8c-9ba4-7f69ae7a2c5a","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://znn4zk2xc3.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://znn4zk2xc3.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4548863-0fb1-53ab-bb80-052fb18b9aa5","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"txlozah984.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'txlozah984.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3b5633c-586a-54af-a43a-adb65b1b5a4b","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://txlozah984.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://txlozah984.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbb985ec-dd3f-5690-a53f-53c0b7b8ca5c","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"invoice-deliver.mu7p0.rs0kin1d9c.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice-deliver.mu7p0.rs0kin1d9c.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a82fd9d1-9c1a-57f2-a284-3afcd15b7bcf","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://invoice-deliver.mu7p0.rs0kin1d9c.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice-deliver.mu7p0.rs0kin1d9c.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b80acaa9-1408-5aab-8dec-f3af3e881b3d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"doc-verification.s1x5lf.vitheq17yl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc-verification.s1x5lf.vitheq17yl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64a60694-9e53-524a-9be1-4b5d40ac8b1d","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://doc-verification.s1x5lf.vitheq17yl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc-verification.s1x5lf.vitheq17yl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30c4e3ed-5b72-5e0d-a494-d0cec9926a88","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"f24giigz4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'f24giigz4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f7037bd-e996-57fb-8b54-70b91c7af38f","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://f24giigz4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://f24giigz4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb1fe924-db9a-551b-939d-0d023d8d1921","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"http://152.32.139.36","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://152.32.139.36']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46822377-f060-5f12-84d2-e94f6ce05c23","created":"2026-05-14T20:57:00.000Z","modified":"2026-05-14T20:57:00.000Z","valid_from":"2026-05-14T20:57:00.000Z","name":"152.32.139.36","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '152.32.139.36']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055029645125296604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85125b6e-c057-5d39-8e48-239976066de2","created":"2026-05-14T22:00:00.000Z","modified":"2026-05-14T22:00:00.000Z","valid_from":"2026-05-14T22:00:00.000Z","name":"officialdangerboy.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'officialdangerboy.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055045522453299359"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a43f606-85f7-58ea-82cb-73e23258ed3f","created":"2026-05-14T22:00:00.000Z","modified":"2026-05-14T22:00:00.000Z","valid_from":"2026-05-14T22:00:00.000Z","name":"https://officialdangerboy.github.io/NetflixClone/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://officialdangerboy.github.io/NetflixClone/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055045522453299359"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33d0af95-0a9c-57b0-b9f4-5ddf71c3289a","created":"2026-05-14T22:01:00.000Z","modified":"2026-05-14T22:01:00.000Z","valid_from":"2026-05-14T22:01:00.000Z","name":"959dca4b7989546a18a3f5e016c4bd78cfd825a1e679cefe0a355e739605937f","description":"IOC reported by @SquiblydooBlog on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '959dca4b7989546a18a3f5e016c4bd78cfd825a1e679cefe0a355e739605937f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SquiblydooBlog/status/2055045916340658329"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a79a5a3-7121-567c-ba35-458f2be145db","created":"2026-05-14T22:01:00.000Z","modified":"2026-05-14T22:01:00.000Z","valid_from":"2026-05-14T22:01:00.000Z","name":"6210caacd4c7a3219ad6327b714c53d286443104ba06e3c4270f7e9a5d25ecee","description":"IOC reported by @SquiblydooBlog on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '6210caacd4c7a3219ad6327b714c53d286443104ba06e3c4270f7e9a5d25ecee']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SquiblydooBlog/status/2055045916340658329"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a13cff5-ba76-522b-8ec2-f2768ed53b7a","created":"2026-05-14T22:29:00.000Z","modified":"2026-05-14T22:29:00.000Z","valid_from":"2026-05-14T22:29:00.000Z","name":"85456be1c9b293aa8ad788d27ffc6f8bb2118b5cbfce1522c9168ac1236a88e2","description":"IOC reported by @SquiblydooBlog on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '85456be1c9b293aa8ad788d27ffc6f8bb2118b5cbfce1522c9168ac1236a88e2']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SquiblydooBlog/status/2055052904298680442"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7badfa77-d39d-5f59-8d23-ede121eb805a","created":"2026-05-15T00:00:00.000Z","modified":"2026-05-15T00:00:00.000Z","valid_from":"2026-05-15T00:00:00.000Z","name":"studentsmuetedu.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'studentsmuetedu.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055075759597781437"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69e9bd7d-93e4-5051-902a-293eb99dedd4","created":"2026-05-15T00:00:00.000Z","modified":"2026-05-15T00:00:00.000Z","valid_from":"2026-05-15T00:00:00.000Z","name":"https://studentsmuetedu.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://studentsmuetedu.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055075759597781437"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bca3922d-0d52-5df3-a0d4-b72a080a37a6","created":"2026-05-15T00:29:00.000Z","modified":"2026-05-15T00:29:00.000Z","valid_from":"2026-05-15T00:29:00.000Z","name":"allegro.73923-g03912.lat","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'allegro.73923-g03912.lat']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055082991819391273"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35e4eb40-5fe2-5e4a-9d47-e5bc06201d10","created":"2026-05-15T00:29:00.000Z","modified":"2026-05-15T00:29:00.000Z","valid_from":"2026-05-15T00:29:00.000Z","name":"https://allegro.73923-g03912.lat","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://allegro.73923-g03912.lat']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055082991819391273"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b615d4c6-dd14-5bf5-988b-06457f6d3509","created":"2026-05-15T01:03:00.000Z","modified":"2026-05-15T01:03:00.000Z","valid_from":"2026-05-15T01:03:00.000Z","name":"uqcoop.com","description":"IOC reported by @CTI_FYI on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uqcoop.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CTI_FYI/status/2055091617795866722"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d61a5234-aa76-502f-8ab9-81ab5e259c5c","created":"2026-05-15T01:03:00.000Z","modified":"2026-05-15T01:03:00.000Z","valid_from":"2026-05-15T01:03:00.000Z","name":"http://www.uqcoop.com","description":"IOC reported by @CTI_FYI on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.uqcoop.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CTI_FYI/status/2055091617795866722"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--849bbfb4-5ecf-54a1-8fbc-b20644ad460d","created":"2026-05-15T02:00:00.000Z","modified":"2026-05-15T02:00:00.000Z","valid_from":"2026-05-15T02:00:00.000Z","name":"bafybeicscheq46bkhy3btg3u4sqltfujfkjmouv2z6h2pxvp3nbfjyggry.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bafybeicscheq46bkhy3btg3u4sqltfujfkjmouv2z6h2pxvp3nbfjyggry.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055105925178941518"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3aeeebbf-bf3a-5777-a17e-62880cc1723c","created":"2026-05-15T02:00:00.000Z","modified":"2026-05-15T02:00:00.000Z","valid_from":"2026-05-15T02:00:00.000Z","name":"http://bafybeicscheq46bkhy3btg3u4sqltfujfkjmouv2z6h2pxvp3nbfjyggry.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bafybeicscheq46bkhy3btg3u4sqltfujfkjmouv2z6h2pxvp3nbfjyggry.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055105925178941518"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6574f54d-1e48-50c3-b63c-4e2428f58492","created":"2026-05-15T04:00:00.000Z","modified":"2026-05-15T04:00:00.000Z","valid_from":"2026-05-15T04:00:00.000Z","name":"rnarkdills52-my-cheetah-website.site.builderallsite.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rnarkdills52-my-cheetah-website.site.builderallsite.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055136119109349772"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a32d8f9e-1263-5755-be59-60ddf86f4075","created":"2026-05-15T04:00:00.000Z","modified":"2026-05-15T04:00:00.000Z","valid_from":"2026-05-15T04:00:00.000Z","name":"https://rnarkdills52-my-cheetah-website.site.builderallsite.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rnarkdills52-my-cheetah-website.site.builderallsite.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055136119109349772"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0ad0ba0-0bfd-535e-bb19-3692779536dd","created":"2026-05-15T04:27:00.000Z","modified":"2026-05-15T04:27:00.000Z","valid_from":"2026-05-15T04:27:00.000Z","name":"82.165.117.72","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '82.165.117.72']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055142889819386290"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ebec736-d2e7-56fa-957c-67e1aec5a070","created":"2026-05-15T04:27:00.000Z","modified":"2026-05-15T04:27:00.000Z","valid_from":"2026-05-15T04:27:00.000Z","name":"28355d24778995371c72eb59629f622c0e4c1d023148f0ab8a3dbe7a0582ca0c","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '28355d24778995371c72eb59629f622c0e4c1d023148f0ab8a3dbe7a0582ca0c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055142889819386290"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e19bf942-857b-5eac-b9ab-cec86c0a21d1","created":"2026-05-15T04:27:00.000Z","modified":"2026-05-15T04:27:00.000Z","valid_from":"2026-05-15T04:27:00.000Z","name":"485ddc0020a483f5e97a1ea91f6d915f7cfb909bf9662fbb4655eafc93ca39af","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '485ddc0020a483f5e97a1ea91f6d915f7cfb909bf9662fbb4655eafc93ca39af']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055142889819386290"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4c3b3fe-34c5-52fd-a885-41258c464893","created":"2026-05-15T05:18:00.000Z","modified":"2026-05-15T05:18:00.000Z","valid_from":"2026-05-15T05:18:00.000Z","name":"topsuperaffiliate.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'topsuperaffiliate.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055155784502423598"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f7fcf83-7d0d-563d-84bc-69ab65c45cf9","created":"2026-05-15T05:18:00.000Z","modified":"2026-05-15T05:18:00.000Z","valid_from":"2026-05-15T05:18:00.000Z","name":"https://topsuperaffiliate.com/?type=verify&key=ivqvtvails","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://topsuperaffiliate.com/?type=verify&key=ivqvtvails']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055155784502423598"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddd1e711-7965-5113-ae8f-74b36dde60f8","created":"2026-05-15T05:18:00.000Z","modified":"2026-05-15T05:18:00.000Z","valid_from":"2026-05-15T05:18:00.000Z","name":"espdfhufmmh.top","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'espdfhufmmh.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055155784502423598"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9445ce3d-e4c6-5c84-b650-aa8b74be6ff2","created":"2026-05-15T05:18:00.000Z","modified":"2026-05-15T05:18:00.000Z","valid_from":"2026-05-15T05:18:00.000Z","name":"https://espdfhufmmh.top/jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://espdfhufmmh.top/jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055155784502423598"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29b86145-054d-571c-9bf3-33a11e4ba850","created":"2026-05-15T05:18:00.000Z","modified":"2026-05-15T05:18:00.000Z","valid_from":"2026-05-15T05:18:00.000Z","name":"34.146.132.29","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.146.132.29']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055155784502423598"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e6410a1-65eb-564b-923b-9dc2c1f1cee1","created":"2026-05-15T05:19:00.000Z","modified":"2026-05-15T05:19:00.000Z","valid_from":"2026-05-15T05:19:00.000Z","name":"freesentencechecker.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'freesentencechecker.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055156107610636623"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--533164f2-f88c-5bc0-9092-290133830979","created":"2026-05-15T05:19:00.000Z","modified":"2026-05-15T05:19:00.000Z","valid_from":"2026-05-15T05:19:00.000Z","name":"https://freesentencechecker.com/?type=verify&key=ooahuxpuge","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://freesentencechecker.com/?type=verify&key=ooahuxpuge']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055156107610636623"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--005db956-3e45-56ff-b7b6-e34ad6ed6e75","created":"2026-05-15T05:19:00.000Z","modified":"2026-05-15T05:19:00.000Z","valid_from":"2026-05-15T05:19:00.000Z","name":"35.221.107.188","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '35.221.107.188']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055156107610636623"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7415361b-f45d-51f0-bbbc-8c8adc048ebd","created":"2026-05-15T05:19:00.000Z","modified":"2026-05-15T05:19:00.000Z","valid_from":"2026-05-15T05:19:00.000Z","name":"101.32.97.203","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '101.32.97.203']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055156107610636623"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54d84a8a-b2b5-5812-ab76-badef0695c5a","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"8.218.252.45","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.218.252.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e16d90fe-eb59-5a00-88b1-d4e583d4933c","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"38.46.13.178","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '38.46.13.178']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9c8dd31-8397-554d-b626-ed52def44a62","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"43.106.13.203","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.106.13.203']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e472494-ac2d-5698-bd88-e0e9bcb9a5c2","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"43.229.114.154","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.229.114.154']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d54efed9-c5dc-5a0f-90cc-3b4766e70bb2","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"45.113.1.247","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.113.1.247']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--41ce5e60-b908-5245-bbf8-b4f4dd5d43ee","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"45.197.237.53","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.197.237.53']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a921a1c6-2f71-56c7-a2a7-09009aeada73","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"47.76.156.68","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.76.156.68']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b31bc9e5-69cd-5fa1-9b2f-aaf4216b3aa3","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"47.84.34.181","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.84.34.181']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--61de46ff-c067-50b9-a3e4-6bd51913eb08","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"47.84.47.90","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.84.47.90']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c8641fc-6d40-54a2-9b43-389e59ca974a","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"47.98.129.153","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.98.129.153']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca752a76-11f1-597c-9bb6-2877fff5c66e","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"47.109.87.101","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.109.87.101']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fac764d-3594-55d6-b504-a0751b2fb634","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"47.236.106.45","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.236.106.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--638a900d-5209-5520-93c5-85585f61179d","created":"2026-05-15T05:29:00.000Z","modified":"2026-05-15T05:29:00.000Z","valid_from":"2026-05-15T05:29:00.000Z","name":"103.45.65.107","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '103.45.65.107']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055158609504358434"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1372121-fb76-5a56-91bc-1962931be1c8","created":"2026-05-15T05:42:00.000Z","modified":"2026-05-15T05:42:00.000Z","valid_from":"2026-05-15T05:42:00.000Z","name":"23.95.217.139","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '23.95.217.139']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055161853198630952"}],"labels":["AsyncRAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29f2679a-beff-5e32-815c-7f947462a770","created":"2026-05-15T05:42:00.000Z","modified":"2026-05-15T05:42:00.000Z","valid_from":"2026-05-15T05:42:00.000Z","name":"45.92.1.165","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.92.1.165']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055161853198630952"}],"labels":["AsyncRAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acf23a03-c090-55bb-8ab9-77d5c473918d","created":"2026-05-15T05:42:00.000Z","modified":"2026-05-15T05:42:00.000Z","valid_from":"2026-05-15T05:42:00.000Z","name":"87.120.107.68","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '87.120.107.68']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055161853198630952"}],"labels":["AsyncRAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--181a99f3-af86-595c-9af9-7e4d303255f1","created":"2026-05-15T05:42:00.000Z","modified":"2026-05-15T05:42:00.000Z","valid_from":"2026-05-15T05:42:00.000Z","name":"91.219.238.166","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '91.219.238.166']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055161853198630952"}],"labels":["AsyncRAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cd89235-2a34-5c9e-bedb-0d91d5324b4f","created":"2026-05-15T05:42:00.000Z","modified":"2026-05-15T05:42:00.000Z","valid_from":"2026-05-15T05:42:00.000Z","name":"103.59.103.93","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '103.59.103.93']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055161853198630952"}],"labels":["AsyncRAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--836687e5-43dc-52e6-9561-dd292c958d66","created":"2026-05-15T05:42:00.000Z","modified":"2026-05-15T05:42:00.000Z","valid_from":"2026-05-15T05:42:00.000Z","name":"154.36.188.98","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '154.36.188.98']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055161853198630952"}],"labels":["AsyncRAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--081deb26-fcf2-5fe0-abae-9a5fae8a1ca1","created":"2026-05-15T05:42:00.000Z","modified":"2026-05-15T05:42:00.000Z","valid_from":"2026-05-15T05:42:00.000Z","name":"176.65.139.96","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '176.65.139.96']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2055161853198630952"}],"labels":["AsyncRAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--015dbfd9-6917-5c68-a786-30cfa8984c63","created":"2026-05-15T05:50:00.000Z","modified":"2026-05-15T05:50:00.000Z","valid_from":"2026-05-15T05:50:00.000Z","name":"doctramo.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doctramo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055163923616452699"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f7f8822-5b54-5703-95f9-ac4b7759b258","created":"2026-05-15T05:50:00.000Z","modified":"2026-05-15T05:50:00.000Z","valid_from":"2026-05-15T05:50:00.000Z","name":"https://doctramo.com/track/click/izlo","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://doctramo.com/track/click/izlo']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055163923616452699"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83962fdd-4bed-582e-b46f-dd2e75c59a05","created":"2026-05-15T05:50:00.000Z","modified":"2026-05-15T05:50:00.000Z","valid_from":"2026-05-15T05:50:00.000Z","name":"140.238.142.213","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '140.238.142.213']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055163923616452699"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0302da22-7d97-5757-a0cf-8193435b6224","created":"2026-05-15T05:50:00.000Z","modified":"2026-05-15T05:50:00.000Z","valid_from":"2026-05-15T05:50:00.000Z","name":"koingy.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'koingy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055163768028729769"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66aee57f-421f-58db-adab-4e541ccb70a2","created":"2026-05-15T05:50:00.000Z","modified":"2026-05-15T05:50:00.000Z","valid_from":"2026-05-15T05:50:00.000Z","name":"https://koingy.com/page/bqcp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://koingy.com/page/bqcp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055163768028729769"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fde3c10-cd1e-5cdb-aaac-a33de9c9ecaa","created":"2026-05-15T05:50:00.000Z","modified":"2026-05-15T05:50:00.000Z","valid_from":"2026-05-15T05:50:00.000Z","name":"165.1.65.224","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.1.65.224']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055163768028729769"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81278277-ce5f-5d4f-9b04-a565804283df","created":"2026-05-15T05:53:00.000Z","modified":"2026-05-15T05:53:00.000Z","valid_from":"2026-05-15T05:53:00.000Z","name":"app-zh-heibaisports.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'app-zh-heibaisports.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055164637973504209"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1a34d16-1e4c-5588-a139-264967c5ef29","created":"2026-05-15T05:53:00.000Z","modified":"2026-05-15T05:53:00.000Z","valid_from":"2026-05-15T05:53:00.000Z","name":"https://app-zh-heibaisports.com/?from=campaign&token=gsgmxmpcab","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://app-zh-heibaisports.com/?from=campaign&token=gsgmxmpcab']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055164637973504209"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f044a16-adc4-5830-aea4-c349e14fd645","created":"2026-05-15T05:53:00.000Z","modified":"2026-05-15T05:53:00.000Z","valid_from":"2026-05-15T05:53:00.000Z","name":"23.254.167.135","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '23.254.167.135']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055164637973504209"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91c9864c-75ca-54af-b790-c7feb2ea7896","created":"2026-05-15T06:00:00.000Z","modified":"2026-05-15T06:00:00.000Z","valid_from":"2026-05-15T06:00:00.000Z","name":"eklavya98.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eklavya98.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055166333277356217"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb0b8a7d-ed12-5674-823c-22d7258a7a1c","created":"2026-05-15T06:00:00.000Z","modified":"2026-05-15T06:00:00.000Z","valid_from":"2026-05-15T06:00:00.000Z","name":"https://eklavya98.github.io/netflix-landing-page","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://eklavya98.github.io/netflix-landing-page']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055166333277356217"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9030a346-7476-59d9-950a-212cd088b842","created":"2026-05-15T06:04:00.000Z","modified":"2026-05-15T06:04:00.000Z","valid_from":"2026-05-15T06:04:00.000Z","name":"147.45.45.245","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.45.45.245']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2055167453487845577"}],"labels":["ClickFix","NetSupport","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa63a9eb-6a5f-59fb-b484-da26eaec93da","created":"2026-05-15T06:04:00.000Z","modified":"2026-05-15T06:04:00.000Z","valid_from":"2026-05-15T06:04:00.000Z","name":"95.85.246.222","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '95.85.246.222']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2055167453487845577"}],"labels":["ClickFix","NetSupport","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bb22731-1b22-5363-9ebb-b9212084e07c","created":"2026-05-15T06:13:00.000Z","modified":"2026-05-15T06:13:00.000Z","valid_from":"2026-05-15T06:13:00.000Z","name":"cwzxpx.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cwzxpx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055169637550338557"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd712720-b067-5747-9e34-ec18cd2c3d24","created":"2026-05-15T06:13:00.000Z","modified":"2026-05-15T06:13:00.000Z","valid_from":"2026-05-15T06:13:00.000Z","name":"https://cwzxpx.com/?type=verify&key=ywewccmdmm","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cwzxpx.com/?type=verify&key=ywewccmdmm']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055169637550338557"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--432b1a8d-a6d9-5627-807e-c1e5313d6a44","created":"2026-05-15T06:13:00.000Z","modified":"2026-05-15T06:13:00.000Z","valid_from":"2026-05-15T06:13:00.000Z","name":"azrbmwvdcus.top","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'azrbmwvdcus.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055169637550338557"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--866f0bdd-7c2e-5eca-9cba-98ee5367ff2d","created":"2026-05-15T06:13:00.000Z","modified":"2026-05-15T06:13:00.000Z","valid_from":"2026-05-15T06:13:00.000Z","name":"https://azrbmwvdcus.top/jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://azrbmwvdcus.top/jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055169637550338557"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc231c4b-c1b8-5080-9e67-4c70b91daa08","created":"2026-05-15T06:13:00.000Z","modified":"2026-05-15T06:13:00.000Z","valid_from":"2026-05-15T06:13:00.000Z","name":"43.128.252.32","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.128.252.32']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055169637550338557"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd5a88af-ab5f-55ba-8424-44d612b0c4b7","created":"2026-05-15T06:14:00.000Z","modified":"2026-05-15T06:14:00.000Z","valid_from":"2026-05-15T06:14:00.000Z","name":"hbtsqs.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hbtsqs.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055169808631758944"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d33b2b27-078e-5954-9e28-0b4c1dde7ec2","created":"2026-05-15T06:14:00.000Z","modified":"2026-05-15T06:14:00.000Z","valid_from":"2026-05-15T06:14:00.000Z","name":"https://hbtsqs.com/?type=verify&key=wzknooeoga","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hbtsqs.com/?type=verify&key=wzknooeoga']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2055169808631758944"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--859f67ef-ea7f-5ca8-8e47-d815f82cfe80","created":"2026-05-15T07:31:00.000Z","modified":"2026-05-15T07:31:00.000Z","valid_from":"2026-05-15T07:31:00.000Z","name":"e-stat.b8no2fhz.shop","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.b8no2fhz.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055189376964116768"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eed92c4-db67-5852-92da-f560dc654ae5","created":"2026-05-15T07:31:00.000Z","modified":"2026-05-15T07:31:00.000Z","valid_from":"2026-05-15T07:31:00.000Z","name":"https://e-stat.b8no2fhz.shop","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.b8no2fhz.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055189376964116768"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--35d95a92-8892-5c9b-ba20-3ef66f038b8d","created":"2026-05-15T07:31:00.000Z","modified":"2026-05-15T07:31:00.000Z","valid_from":"2026-05-15T07:31:00.000Z","name":"e-stat.9g4icuky.shop","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.9g4icuky.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055189376964116768"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e7c4dd2-f83e-5a41-a06f-a82006550a79","created":"2026-05-15T07:31:00.000Z","modified":"2026-05-15T07:31:00.000Z","valid_from":"2026-05-15T07:31:00.000Z","name":"https://e-stat.9g4icuky.shop","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.9g4icuky.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055189376964116768"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--458841f0-85a1-55d4-b496-f2b9b0d28d72","created":"2026-05-15T07:31:00.000Z","modified":"2026-05-15T07:31:00.000Z","valid_from":"2026-05-15T07:31:00.000Z","name":"e-stat.88vj90ot.shop","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.88vj90ot.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055189376964116768"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a913398b-43eb-5109-931c-04bc55ed8f18","created":"2026-05-15T07:31:00.000Z","modified":"2026-05-15T07:31:00.000Z","valid_from":"2026-05-15T07:31:00.000Z","name":"https://e-stat.88vj90ot.shop","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.88vj90ot.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055189376964116768"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--91e00b5d-027a-5988-9624-36a6114fc074","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"caresarigul.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'caresarigul.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7becdefa-9763-556c-bc25-901de05cd1d1","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://caresarigul.com/Jo9IWmGErv.or.jp","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://caresarigul.com/Jo9IWmGErv.or.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e27310c-2503-5707-a090-453c1b24db97","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.tauruscaesar.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.tauruscaesar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bab9d41-ae98-56ae-9dcc-5375fd789e2c","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.tauruscaesar.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.tauruscaesar.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9186b69-1ce1-57cb-9c26-784332de038c","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smc-vbass-crad.sendusyourspit.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smc-vbass-crad.sendusyourspit.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dbb9c5d-6305-5dec-b057-d0fcc39d1ff1","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smc-vbass-crad.sendusyourspit.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smc-vbass-crad.sendusyourspit.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0899ff6-af60-558e-ba67-500f74763cbc","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.edgeapk.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.edgeapk.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--19e99900-e32a-50cb-9650-124b24c77b4c","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.edgeapk.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.edgeapk.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--89e7d91e-8caa-5d29-977a-340219cf357c","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smc-vbass-crad.balicarscharter.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smc-vbass-crad.balicarscharter.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd02722e-6cdb-5437-84af-61b3e5a0293b","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smc-vbass-crad.balicarscharter.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smc-vbass-crad.balicarscharter.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--71d3c18c-9fb7-5bbf-80b4-61bbc0fae04e","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.weiyatongyong.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.weiyatongyong.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--10082683-4fec-5d77-b7f6-35f1fef63101","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.weiyatongyong.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.weiyatongyong.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0b27096-15d5-544e-8860-9334150319ba","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.ktfautomotive.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.ktfautomotive.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--419d6b1a-a0b3-5a74-a12f-e666c2ea6627","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.ktfautomotive.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.ktfautomotive.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e32c7fdc-e4dd-527c-a1e3-44bbc83bafee","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.hbyyhlzyxx.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.hbyyhlzyxx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--097e1739-9e64-5ef6-a43c-cd7701ce305e","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.hbyyhlzyxx.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.hbyyhlzyxx.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--41d0e288-93ba-50d0-943b-4a3bd21d9747","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.iriefreshspray.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.iriefreshspray.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2cb85be-78a6-5130-a662-dcf2d2f1e375","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.iriefreshspray.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.iriefreshspray.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--778b5e67-652f-5cf4-b01b-9af90dd5d1a7","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.fitnessdandj.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.fitnessdandj.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf462601-c8d2-5751-87e4-8391b62de0d1","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.fitnessdandj.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.fitnessdandj.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d8adac5-0e69-594b-8744-89b419f97c42","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"smbc-card-verification.thebranduc.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card-verification.thebranduc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4e996b1-5b42-503f-b9f0-553a4ed464dd","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"https://smbc-card-verification.thebranduc.com/Login/","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card-verification.thebranduc.com/Login/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2429137b-e517-5261-b80e-a8ef4d6212e4","created":"2026-05-15T07:35:00.000Z","modified":"2026-05-15T07:35:00.000Z","valid_from":"2026-05-15T07:35:00.000Z","name":"172.245.142.10","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '172.245.142.10']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055190202419962328"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a888c561-f907-573c-a56b-dec72ca3597d","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"rakuten-card-pay1-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuten-card-pay1-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--74ce1188-d2e9-50ff-82b1-f4ad8012dae4","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"https://rakuten-card-pay1-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rakuten-card-pay1-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8af1020d-e148-5533-add9-2a1a07dd319e","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"rakutew-card-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakutew-card-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3d5da1d-6386-56cb-9c87-f82eabb1ae03","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"https://rakutew-card-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rakutew-card-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c42de98-c653-5539-99e7-a8049a0872a7","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"rakuteq-card-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuteq-card-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0168a38c-7315-5217-9e1c-59d3dd18b973","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"https://rakuteq-card-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rakuteq-card-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d08e9dd2-0c75-5fa2-9447-ada80842ef0e","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"rakuten-card8-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuten-card8-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb54e41c-a09c-5874-8976-415d9cfbd2bd","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"https://rakuten-card8-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rakuten-card8-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--45ae8319-c4de-5d95-8fd6-215ed118cd06","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"rakuten-card7-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuten-card7-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0804e616-59c6-5103-b0d2-ac6b34065128","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"https://rakuten-card7-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rakuten-card7-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eebc63d1-3b6e-510b-97ba-658c187cf839","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"rakuten-card6-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuten-card6-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--75e89b99-abd0-5e3a-b156-c8c113955b75","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"https://rakuten-card6-jp.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rakuten-card6-jp.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b6955f9-2123-581e-8239-735fa40dde7f","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"rakuten-card6-jp.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuten-card6-jp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d8d2ea1-0f27-502d-aada-4dbac85ec3d0","created":"2026-05-15T07:56:00.000Z","modified":"2026-05-15T07:56:00.000Z","valid_from":"2026-05-15T07:56:00.000Z","name":"https://rakuten-card6-jp.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rakuten-card6-jp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195557464035536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e14476eb-0ed5-55aa-a2a2-f2681b443a35","created":"2026-05-15T07:58:00.000Z","modified":"2026-05-15T07:58:00.000Z","valid_from":"2026-05-15T07:58:00.000Z","name":"smbc-card01.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smbc-card01.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195995580113034"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccc1f899-dfbf-5562-8f23-18ae5836672a","created":"2026-05-15T07:58:00.000Z","modified":"2026-05-15T07:58:00.000Z","valid_from":"2026-05-15T07:58:00.000Z","name":"https://smbc-card01.co","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smbc-card01.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195995580113034"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9504532c-b2b9-510a-96d0-7c71da64e719","created":"2026-05-15T07:58:00.000Z","modified":"2026-05-15T07:58:00.000Z","valid_from":"2026-05-15T07:58:00.000Z","name":"107.155.15.240","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '107.155.15.240']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2055195995580113034"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--06fe38f3-fd45-501f-97c4-c8fb993b5901","created":"2026-05-15T08:00:00.000Z","modified":"2026-05-15T08:00:00.000Z","valid_from":"2026-05-15T08:00:00.000Z","name":"heartofiowa-voice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'heartofiowa-voice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055196526343757978"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62b77b16-f8af-5fb5-9f8e-b4b14faa163e","created":"2026-05-15T08:00:00.000Z","modified":"2026-05-15T08:00:00.000Z","valid_from":"2026-05-15T08:00:00.000Z","name":"https://heartofiowa-voice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://heartofiowa-voice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055196526343757978"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31fe7f3c-9b6b-5a23-8d81-f3f6cfa4cc5b","created":"2026-05-15T08:06:00.000Z","modified":"2026-05-15T08:06:00.000Z","valid_from":"2026-05-15T08:06:00.000Z","name":"lod.ink","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lod.ink']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2055198167730143461"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--96bc5cc0-7e20-585c-9890-0d229ab15ba6","created":"2026-05-15T08:06:00.000Z","modified":"2026-05-15T08:06:00.000Z","valid_from":"2026-05-15T08:06:00.000Z","name":"http://lod.ink","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lod.ink']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2055198167730143461"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b81ccf5-8ece-52b8-9d8e-c1f3edd1c80e","created":"2026-05-15T08:06:00.000Z","modified":"2026-05-15T08:06:00.000Z","valid_from":"2026-05-15T08:06:00.000Z","name":"706ecb1237915ae7946524d1ed4dbca0","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '706ecb1237915ae7946524d1ed4dbca0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2055198167730143461"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--550f66fa-44f4-5240-99cf-3d4a197f5c0e","created":"2026-05-15T08:06:00.000Z","modified":"2026-05-15T08:06:00.000Z","valid_from":"2026-05-15T08:06:00.000Z","name":"183f2e2810dcffafce158a3483766ffa","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '183f2e2810dcffafce158a3483766ffa']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2055198167730143461"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3973cf78-c22d-540e-8a2d-e1e5cca16423","created":"2026-05-15T09:24:00.000Z","modified":"2026-05-15T09:24:00.000Z","valid_from":"2026-05-15T09:24:00.000Z","name":"https://pastebin.com/raw/XpGZN2s9","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://pastebin.com/raw/XpGZN2s9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055217774901784978"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c13d6981-61a1-5b1d-8cf6-6cbea94cc987","created":"2026-05-15T09:24:00.000Z","modified":"2026-05-15T09:24:00.000Z","valid_from":"2026-05-15T09:24:00.000Z","name":"https://pastebin.com/raw/VnpF67Qv","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://pastebin.com/raw/VnpF67Qv']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055217774901784978"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--28f7003e-fa80-5c8e-8982-7779ce5dfd0c","created":"2026-05-15T09:24:00.000Z","modified":"2026-05-15T09:24:00.000Z","valid_from":"2026-05-15T09:24:00.000Z","name":"https://api.telegram.org/bot8696116364:AAFJwaooySgPFzW3SeGiiDtCjw5Pxb_78cU","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://api.telegram.org/bot8696116364:AAFJwaooySgPFzW3SeGiiDtCjw5Pxb_78cU']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055217774901784978"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--73254ef1-9c52-5148-b277-3bb3c632da1d","created":"2026-05-15T09:24:00.000Z","modified":"2026-05-15T09:24:00.000Z","valid_from":"2026-05-15T09:24:00.000Z","name":"1ed3b69515186cea6441b60526112d55facb7606543116b4061e3a862d29b572","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '1ed3b69515186cea6441b60526112d55facb7606543116b4061e3a862d29b572']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055217774901784978"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb52fdcc-f563-5a32-8f92-052e83eef284","created":"2026-05-15T09:28:00.000Z","modified":"2026-05-15T09:28:00.000Z","valid_from":"2026-05-15T09:28:00.000Z","name":"01593287286f40bf5305f2d54962fdbcb8a4b6c4a5c0912b6f2e5826bea9c741","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '01593287286f40bf5305f2d54962fdbcb8a4b6c4a5c0912b6f2e5826bea9c741']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055218740258631743"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8279652e-5634-58b3-adeb-3d2a72d9a1c4","created":"2026-05-15T09:30:00.000Z","modified":"2026-05-15T09:30:00.000Z","valid_from":"2026-05-15T09:30:00.000Z","name":"drive.worksplace.cloud","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'drive.worksplace.cloud']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055219211803193633"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee1d48e1-23d6-5546-a941-36f23c16aeec","created":"2026-05-15T09:30:00.000Z","modified":"2026-05-15T09:30:00.000Z","valid_from":"2026-05-15T09:30:00.000Z","name":"http://drive.worksplace.cloud","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://drive.worksplace.cloud']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055219211803193633"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30cea896-e0ce-5d59-a4c4-3789fb9bbbd0","created":"2026-05-15T09:35:00.000Z","modified":"2026-05-15T09:35:00.000Z","valid_from":"2026-05-15T09:35:00.000Z","name":"remanso00399.ydns.eu","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'remanso00399.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055220477757366720"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f1fc12d-98c1-5de2-8bf0-e4cd09f259a8","created":"2026-05-15T09:35:00.000Z","modified":"2026-05-15T09:35:00.000Z","valid_from":"2026-05-15T09:35:00.000Z","name":"http://remanso00399.ydns.eu","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://remanso00399.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055220477757366720"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8be59fa2-0cd6-54a5-a395-a3fca75ed2db","created":"2026-05-15T09:35:00.000Z","modified":"2026-05-15T09:35:00.000Z","valid_from":"2026-05-15T09:35:00.000Z","name":"15407e60bc4a797fff022a8a21cb1274dda4fb3d004db15814f5f268d9bbfd66","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '15407e60bc4a797fff022a8a21cb1274dda4fb3d004db15814f5f268d9bbfd66']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055220477757366720"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7df4660e-2d45-51d5-b688-ef0cc68d0a96","created":"2026-05-15T09:54:00.000Z","modified":"2026-05-15T09:54:00.000Z","valid_from":"2026-05-15T09:54:00.000Z","name":"b0d1c3dec824760a58c2a138fe2f27c9","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'b0d1c3dec824760a58c2a138fe2f27c9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2055225373869420932"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcb6ab64-a44e-54e1-97be-6e13b4173f3e","created":"2026-05-15T10:00:00.000Z","modified":"2026-05-15T10:00:00.000Z","valid_from":"2026-05-15T10:00:00.000Z","name":"netflix-dusky-chi.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netflix-dusky-chi.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055226703702581252"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1249100a-dd07-5ac9-81ba-cfb714e0ec42","created":"2026-05-15T10:00:00.000Z","modified":"2026-05-15T10:00:00.000Z","valid_from":"2026-05-15T10:00:00.000Z","name":"https://netflix-dusky-chi.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://netflix-dusky-chi.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055226703702581252"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b65ff73-236a-5ca0-87f2-75c3e08b4b53","created":"2026-05-15T10:14:00.000Z","modified":"2026-05-15T10:14:00.000Z","valid_from":"2026-05-15T10:14:00.000Z","name":"wewrurui.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wewrurui.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055230279208357947"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea8f9ee7-4867-5923-9bb3-6c4f743841f7","created":"2026-05-15T10:14:00.000Z","modified":"2026-05-15T10:14:00.000Z","valid_from":"2026-05-15T10:14:00.000Z","name":"http://wewrurui.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://wewrurui.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055230279208357947"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f7fa7cf-452a-5daf-ba28-c81e77e213b7","created":"2026-05-15T10:14:00.000Z","modified":"2026-05-15T10:14:00.000Z","valid_from":"2026-05-15T10:14:00.000Z","name":"http://38.181.22.75","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://38.181.22.75']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055230279208357947"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--993df193-024d-5308-8893-ac8f5b57dc91","created":"2026-05-15T10:14:00.000Z","modified":"2026-05-15T10:14:00.000Z","valid_from":"2026-05-15T10:14:00.000Z","name":"38.181.22.75","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '38.181.22.75']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055230279208357947"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b4f244f-9f87-5b58-84d8-fc2690765c3c","created":"2026-05-15T10:14:00.000Z","modified":"2026-05-15T10:14:00.000Z","valid_from":"2026-05-15T10:14:00.000Z","name":"804295f2e893cab51fdaf1ec0d9bcb4f932a0db263eb31125c0856e053baec66","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '804295f2e893cab51fdaf1ec0d9bcb4f932a0db263eb31125c0856e053baec66']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055230279208357947"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfd93578-11ac-533a-99c0-d58c2bd9e054","created":"2026-05-15T10:47:00.000Z","modified":"2026-05-15T10:47:00.000Z","valid_from":"2026-05-15T10:47:00.000Z","name":"xcancel.com","description":"IOC reported by @Gi7w0rm on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xcancel.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Gi7w0rm/status/2055238626393436495"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--643f0c42-3d0b-5a86-9449-36c4a0bf13c7","created":"2026-05-15T10:47:00.000Z","modified":"2026-05-15T10:47:00.000Z","valid_from":"2026-05-15T10:47:00.000Z","name":"http://xcancel.com","description":"IOC reported by @Gi7w0rm on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xcancel.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Gi7w0rm/status/2055238626393436495"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4d38d9c-51b6-5541-9eab-aafe3d9667fd","created":"2026-05-15T11:27:00.000Z","modified":"2026-05-15T11:27:00.000Z","valid_from":"2026-05-15T11:27:00.000Z","name":"65d0b67b5dbea62cda2adeda51d058d39d489091744fc6a66d2ea9c6878e4e21","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '65d0b67b5dbea62cda2adeda51d058d39d489091744fc6a66d2ea9c6878e4e21']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055248814143869175"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6093fad7-3036-52ac-8692-9eedb6ce964a","created":"2026-05-15T11:32:00.000Z","modified":"2026-05-15T11:32:00.000Z","valid_from":"2026-05-15T11:32:00.000Z","name":"http://120.48.135.246","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://120.48.135.246']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055249855891591666"}],"labels":["CobaltStrike"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61103aa7-7451-5ea1-96af-b0f1ba598f34","created":"2026-05-15T11:32:00.000Z","modified":"2026-05-15T11:32:00.000Z","valid_from":"2026-05-15T11:32:00.000Z","name":"120.48.135.246","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '120.48.135.246']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055249855891591666"}],"labels":["CobaltStrike"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aabc6b6-4679-54a7-8119-71f168e115b1","created":"2026-05-15T11:32:00.000Z","modified":"2026-05-15T11:32:00.000Z","valid_from":"2026-05-15T11:32:00.000Z","name":"ae560539b871e52dd1be3327f60c8a5fd5b38d0db1c267bc6b89d9a6baaffe03","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ae560539b871e52dd1be3327f60c8a5fd5b38d0db1c267bc6b89d9a6baaffe03']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055249855891591666"}],"labels":["CobaltStrike"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8d99dda-e945-5833-b24d-269d57f0d731","created":"2026-05-15T11:36:00.000Z","modified":"2026-05-15T11:36:00.000Z","valid_from":"2026-05-15T11:36:00.000Z","name":"http://103.149.183.183","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://103.149.183.183']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055251029583610152"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f992e3db-1645-5c6f-8446-404d0f0283d8","created":"2026-05-15T11:36:00.000Z","modified":"2026-05-15T11:36:00.000Z","valid_from":"2026-05-15T11:36:00.000Z","name":"103.149.183.183","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '103.149.183.183']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055251029583610152"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5f5e90f-27ba-56f9-ae1f-e1ef02e187ad","created":"2026-05-15T11:36:00.000Z","modified":"2026-05-15T11:36:00.000Z","valid_from":"2026-05-15T11:36:00.000Z","name":"f94ed417839e51f8bcd64969ec7980b3912028cf7fd0925dfe9e83a40d833b7f","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'f94ed417839e51f8bcd64969ec7980b3912028cf7fd0925dfe9e83a40d833b7f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055251029583610152"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bd78662-c07a-50c6-9448-e145ff95d707","created":"2026-05-15T12:01:00.000Z","modified":"2026-05-15T12:01:00.000Z","valid_from":"2026-05-15T12:01:00.000Z","name":"152.53.154.171","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '152.53.154.171']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055257284004212815"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcf14a6f-6829-5554-b992-a1ce8abc7a05","created":"2026-05-15T12:42:00.000Z","modified":"2026-05-15T12:42:00.000Z","valid_from":"2026-05-15T12:42:00.000Z","name":"tax.denzay.eu","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tax.denzay.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2055267601589088540"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ac4af59-fa46-55b3-a8c5-c23ce57bb7d5","created":"2026-05-15T12:42:00.000Z","modified":"2026-05-15T12:42:00.000Z","valid_from":"2026-05-15T12:42:00.000Z","name":"https://tax.denzay.eu/gov/","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://tax.denzay.eu/gov/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2055267601589088540"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c331f3e-ca69-516a-a8dd-747dca80506b","created":"2026-05-15T12:42:00.000Z","modified":"2026-05-15T12:42:00.000Z","valid_from":"2026-05-15T12:42:00.000Z","name":"agenziaentrate.grillwestfrentes.com.ar","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'agenziaentrate.grillwestfrentes.com.ar']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2055267601589088540"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b39102e3-94f3-5522-bdc0-9204b0b9fbda","created":"2026-05-15T12:42:00.000Z","modified":"2026-05-15T12:42:00.000Z","valid_from":"2026-05-15T12:42:00.000Z","name":"https://agenziaentrate.grillwestfrentes.com.ar/rimborso/it/","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://agenziaentrate.grillwestfrentes.com.ar/rimborso/it/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2055267601589088540"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa5b8e6d-3ece-5210-82f2-57568a16eae8","created":"2026-05-15T13:42:00.000Z","modified":"2026-05-15T13:42:00.000Z","valid_from":"2026-05-15T13:42:00.000Z","name":"0e11c4aa285dffe95d2d7e90d974ad0e72336549b0dd2161dec606ba4955e2e1","description":"IOC reported by @v12sec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0e11c4aa285dffe95d2d7e90d974ad0e72336549b0dd2161dec606ba4955e2e1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/v12sec/status/2054834327369003359"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae3a2a6e-2a1d-568c-92a6-ec93c2445f44","created":"2026-05-15T14:00:00.000Z","modified":"2026-05-15T14:00:00.000Z","valid_from":"2026-05-15T14:00:00.000Z","name":"s4w.in","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 's4w.in']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055287149088416018"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f46c788-969e-5226-8907-9b6a90fb0a3a","created":"2026-05-15T14:00:00.000Z","modified":"2026-05-15T14:00:00.000Z","valid_from":"2026-05-15T14:00:00.000Z","name":"https://s4w.in/hxxps-www-roblox-com-users-8188479177-profile","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://s4w.in/hxxps-www-roblox-com-users-8188479177-profile']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055287149088416018"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a67f87f-1aee-5728-84d9-8b4996da5944","created":"2026-05-15T14:11:00.000Z","modified":"2026-05-15T14:11:00.000Z","valid_from":"2026-05-15T14:11:00.000Z","name":"sns.amazonaws.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sns.amazonaws.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2055289888258605175"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5e66636-a728-524f-bc86-e57f2fa1c243","created":"2026-05-15T14:11:00.000Z","modified":"2026-05-15T14:11:00.000Z","valid_from":"2026-05-15T14:11:00.000Z","name":"http://sns.amazonaws.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sns.amazonaws.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2055289888258605175"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be5179fd-cf48-5778-88c2-d3fcaa2d37b7","created":"2026-05-15T14:46:00.000Z","modified":"2026-05-15T14:46:00.000Z","valid_from":"2026-05-15T14:46:00.000Z","name":"kessfullington.com","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kessfullington.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055298774596288846"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--67d24190-3c21-556f-82f3-821fe76fcd02","created":"2026-05-15T14:46:00.000Z","modified":"2026-05-15T14:46:00.000Z","valid_from":"2026-05-15T14:46:00.000Z","name":"http://www.kessfullington.com","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.kessfullington.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055298774596288846"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--02591bc3-1e0e-53ff-99e9-f3dc5e8d46bb","created":"2026-05-15T14:46:00.000Z","modified":"2026-05-15T14:46:00.000Z","valid_from":"2026-05-15T14:46:00.000Z","name":"http://47.79.253.210","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://47.79.253.210']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055298777033097276"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e127b3-01b4-5e3e-a519-713a28675fb4","created":"2026-05-15T14:46:00.000Z","modified":"2026-05-15T14:46:00.000Z","valid_from":"2026-05-15T14:46:00.000Z","name":"http://43.165.179.173:5000","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.165.179.173:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055298777033097276"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0d3a51e-28a3-5f1a-a5ce-edbf147ca662","created":"2026-05-15T14:46:00.000Z","modified":"2026-05-15T14:46:00.000Z","valid_from":"2026-05-15T14:46:00.000Z","name":"47.79.253.210","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.79.253.210']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055298777033097276"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--092b762a-57db-53b3-92e7-d177eef6cbfd","created":"2026-05-15T14:46:00.000Z","modified":"2026-05-15T14:46:00.000Z","valid_from":"2026-05-15T14:46:00.000Z","name":"43.165.179.173","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.165.179.173']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055298777033097276"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e0be4b-2daf-57f3-ac2a-30040aa7ff25","created":"2026-05-15T14:46:00.000Z","modified":"2026-05-15T14:46:00.000Z","valid_from":"2026-05-15T14:46:00.000Z","name":"0d958f13d6ed44143b5b58fcf29bf4b4df7fc121e187f2ca90ea64ec80650b38","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0d958f13d6ed44143b5b58fcf29bf4b4df7fc121e187f2ca90ea64ec80650b38']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055298777033097276"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b6c7b03-a711-5e0c-a492-55c85c07e973","created":"2026-05-15T14:58:00.000Z","modified":"2026-05-15T14:58:00.000Z","valid_from":"2026-05-15T14:58:00.000Z","name":"c29t1jqg9qfc16yycas6eq0jyhz.live","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c29t1jqg9qfc16yycas6eq0jyhz.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055301912145387902"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b2aa54f-722c-5793-a98f-e75dddc09252","created":"2026-05-15T14:58:00.000Z","modified":"2026-05-15T14:58:00.000Z","valid_from":"2026-05-15T14:58:00.000Z","name":"https://c29t1jqg9qfc16yycas6eq0jyhz.live","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://c29t1jqg9qfc16yycas6eq0jyhz.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055301912145387902"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef5f2ac2-4912-52b9-939a-62a0578099d5","created":"2026-05-15T14:58:00.000Z","modified":"2026-05-15T14:58:00.000Z","valid_from":"2026-05-15T14:58:00.000Z","name":"e7ea5eb83bf6e9b1cc603ca13c0f363b164ccb712fbf90300cc52e91c53e2e08","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'e7ea5eb83bf6e9b1cc603ca13c0f363b164ccb712fbf90300cc52e91c53e2e08']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055301912145387902"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2429ed46-29a0-529d-9042-cf1268be76aa","created":"2026-05-15T14:58:00.000Z","modified":"2026-05-15T14:58:00.000Z","valid_from":"2026-05-15T14:58:00.000Z","name":"http://38.47.227.212:56004","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://38.47.227.212:56004']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055301914854842633"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b04f9a98-90db-54fa-ac55-9881dcd5e6ac","created":"2026-05-15T14:58:00.000Z","modified":"2026-05-15T14:58:00.000Z","valid_from":"2026-05-15T14:58:00.000Z","name":"38.47.227.212","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '38.47.227.212']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055301914854842633"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea9e08f4-5291-52d0-9019-fb05fa957a5a","created":"2026-05-15T15:16:00.000Z","modified":"2026-05-15T15:16:00.000Z","valid_from":"2026-05-15T15:16:00.000Z","name":"therealmainstream.com","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'therealmainstream.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2055306274229682474"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c11cfd1-40fc-5f97-bf4c-5a97e0b825f9","created":"2026-05-15T15:16:00.000Z","modified":"2026-05-15T15:16:00.000Z","valid_from":"2026-05-15T15:16:00.000Z","name":"http://therealmainstream.com","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://therealmainstream.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2055306274229682474"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d485ac1-5473-5113-b772-2f2285df9e6e","created":"2026-05-15T15:16:00.000Z","modified":"2026-05-15T15:16:00.000Z","valid_from":"2026-05-15T15:16:00.000Z","name":"minework.io","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'minework.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2055306274229682474"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1fcbfce-8961-53d3-a745-10de27512f3d","created":"2026-05-15T15:16:00.000Z","modified":"2026-05-15T15:16:00.000Z","valid_from":"2026-05-15T15:16:00.000Z","name":"http://minework.io","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://minework.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2055306274229682474"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b10ca44c-2872-54cd-bfcd-0080f42f626c","created":"2026-05-15T15:16:00.000Z","modified":"2026-05-15T15:16:00.000Z","valid_from":"2026-05-15T15:16:00.000Z","name":"c426ac3433450641441a60d9ab3c57f08ff9453a2486896a2f269452e604b08f","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c426ac3433450641441a60d9ab3c57f08ff9453a2486896a2f269452e604b08f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2055306274229682474"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7734a6b-ef4d-59eb-80e7-27329be622a1","created":"2026-05-15T16:00:00.000Z","modified":"2026-05-15T16:00:00.000Z","valid_from":"2026-05-15T16:00:00.000Z","name":"bafkreiauovt77u5bnu4oun62722twfxsaw3l37ji3aqeh3fg6ackly5c5i.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bafkreiauovt77u5bnu4oun62722twfxsaw3l37ji3aqeh3fg6ackly5c5i.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055317332143075421"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5eaf56a-b0ce-57f8-9173-a6fefb33ec97","created":"2026-05-15T16:00:00.000Z","modified":"2026-05-15T16:00:00.000Z","valid_from":"2026-05-15T16:00:00.000Z","name":"https://bafkreiauovt77u5bnu4oun62722twfxsaw3l37ji3aqeh3fg6ackly5c5i.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://bafkreiauovt77u5bnu4oun62722twfxsaw3l37ji3aqeh3fg6ackly5c5i.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055317332143075421"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5ab966-0db0-5210-bb88-ce886a7cd99d","created":"2026-05-15T17:23:00.000Z","modified":"2026-05-15T17:23:00.000Z","valid_from":"2026-05-15T17:23:00.000Z","name":"97752a82abb2b7965007cb5ac6df8725","description":"IOC reported by @ReBensk on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '97752a82abb2b7965007cb5ac6df8725']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ReBensk/status/2055338306347639242"}],"labels":["Android","Trojan","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c26fe64e-dbad-50bd-aa1a-a15289cb9e23","created":"2026-05-15T18:00:00.000Z","modified":"2026-05-15T18:00:00.000Z","valid_from":"2026-05-15T18:00:00.000Z","name":"nid-navercwu.servecounterstrike.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-navercwu.servecounterstrike.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2055347498529829225"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--695b844a-1212-58fd-8433-d3643f32b30c","created":"2026-05-15T18:00:00.000Z","modified":"2026-05-15T18:00:00.000Z","valid_from":"2026-05-15T18:00:00.000Z","name":"http://nid-navercwu.servecounterstrike.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-navercwu.servecounterstrike.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2055347498529829225"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb6d949-690e-570f-9326-f47d4e3ea1f8","created":"2026-05-15T18:00:00.000Z","modified":"2026-05-15T18:00:00.000Z","valid_from":"2026-05-15T18:00:00.000Z","name":"http://27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2055347498529829225"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c41e64fd-bb60-5e1c-a8ea-f62b098b645e","created":"2026-05-15T18:00:00.000Z","modified":"2026-05-15T18:00:00.000Z","valid_from":"2026-05-15T18:00:00.000Z","name":"27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2055347498529829225"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b32cb34-203b-5f84-8b21-56c84c33c937","created":"2026-05-15T18:30:00.000Z","modified":"2026-05-15T18:30:00.000Z","valid_from":"2026-05-15T18:30:00.000Z","name":"cyber.netsecops.io","description":"IOC reported by @NetSecIO on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cyber.netsecops.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/NetSecIO/status/2055355222570999939"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15669f8b-70f7-557c-9e88-99817f7e10c1","created":"2026-05-15T18:30:00.000Z","modified":"2026-05-15T18:30:00.000Z","valid_from":"2026-05-15T18:30:00.000Z","name":"http://cyber.netsecops.io","description":"IOC reported by @NetSecIO on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cyber.netsecops.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/NetSecIO/status/2055355222570999939"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b3a9c5b-ad97-5870-93f4-019a8754f9fb","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid-doc.naveira.tk","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-doc.naveira.tk']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d67deb4-c9f0-58ae-977b-fe5e68fdf746","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid-doc.naveira.tk","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-doc.naveira.tk']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--011aaef1-742b-54a1-bbdd-314deb2ddce8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.puoios.o-r.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.puoios.o-r.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ca4f986-93a8-57e3-b4cb-6b73c1d37be6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.puoios.o-r.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.puoios.o-r.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4311e890-25a2-5647-b814-540d512018e8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"bkkug0us2sj.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bkkug0us2sj.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dbfbf33-4dec-5e79-a885-0ab84c3fb12b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://bkkug0us2sj.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bkkug0us2sj.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0a76224-f8a7-5571-a217-665d6dde1f1c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.nid-check.o-r.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nid-check.o-r.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a6ee3aa-3c0e-545b-bdb9-d9051754a128","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.nid-check.o-r.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nid-check.o-r.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb2af231-4f40-5e27-b324-d348f56c76d7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nisdn.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nisdn.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7d9af78-682c-5f89-84d6-0b62001c0940","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nisdn.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nisdn.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91cd47b0-9bf9-59db-9c7e-915dc5efd2ab","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ninvoice.nisdn.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninvoice.nisdn.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c16a8adb-cf0e-5d26-9612-35699b99800a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ninvoice.nisdn.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninvoice.nisdn.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6bddebf-c2e2-5771-9178-28690e6f01d8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"x94z3llzz6d.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'x94z3llzz6d.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a69bd3d-ae27-5c4e-a908-a969b76006a8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://x94z3llzz6d.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://x94z3llzz6d.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcf1ed0b-a25b-58b4-afa5-616e16083522","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.nauthlogin.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nauthlogin.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b7ca645-01b9-5b11-ab40-8e3322d49b23","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.nauthlogin.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nauthlogin.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46d978c6-1cc2-59de-ac4a-d835c72a3561","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nudoc-check.e639kk.wjyx49u3cu3.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nudoc-check.e639kk.wjyx49u3cu3.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bfbf29a-e90b-5e70-ba2c-63c461459a85","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nudoc-check.e639kk.wjyx49u3cu3.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nudoc-check.e639kk.wjyx49u3cu3.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c63a825-af99-55d2-b8c2-891b8243d2de","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"wjyx49u3cu3.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wjyx49u3cu3.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d13df9ed-4c96-50fc-9afe-fe1fa916d70e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://wjyx49u3cu3.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://wjyx49u3cu3.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fe99d97-01de-5917-92b7-bf4fc6cd36c7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nidsec.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidsec.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a941c709-8264-5518-aa8d-277fb06615a6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nidsec.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidsec.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7645eb15-7dea-521d-baa3-aaab6100dcf3","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.nidsec.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nidsec.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5c68f0f-dd6c-5455-a6ac-e631041e2c66","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.nidsec.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nidsec.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a34e06f-d8b5-50c5-95cd-cafbf98e9f69","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nd8f3lxih4.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nd8f3lxih4.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc688beb-8727-5a47-a774-c06aee117862","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nd8f3lxih4.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nd8f3lxih4.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73c70e46-e374-53ea-b74f-f89895a38ac9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndocsuppport.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocsuppport.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--276ab048-0c70-5d0c-821b-9a18fafa304f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndocsuppport.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocsuppport.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a60e593e-954d-5470-8887-23d225d4d31f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.ndocsuppport.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndocsuppport.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d82d6afe-e0fc-5295-aa49-f48bfc54defd","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.ndocsuppport.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndocsuppport.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cccd27e-a0d3-5acf-8238-04a5d3bb155f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ya7taxdm520.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ya7taxdm520.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72ec3f03-5835-5233-bb22-7e6bba478ade","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ya7taxdm520.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ya7taxdm520.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--803ba3df-eac9-5419-be20-58bd39dd90ce","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nts-doc.xn73zj.vea4cc4pbgk.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts-doc.xn73zj.vea4cc4pbgk.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca688018-3693-5347-a596-07a1e4051932","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nts-doc.xn73zj.vea4cc4pbgk.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts-doc.xn73zj.vea4cc4pbgk.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3014ab5-d529-5a9e-aac4-bea5342fef51","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nts-nid.online","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts-nid.online']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d80e3cd-ffc7-519d-a745-1035d4db147b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nts-nid.online","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts-nid.online']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50928f8a-7d73-5831-b1a4-334f236167a4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndocnid.nts-nid.online","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocnid.nts-nid.online']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90a61c98-dfec-5181-bb9f-74ca94c1b3e0","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndocnid.nts-nid.online","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocnid.nts-nid.online']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51c851f4-751f-51fc-be78-882fe2544fa4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ntsnver.pk9t04.n4zsbi0vab.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntsnver.pk9t04.n4zsbi0vab.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e13d60b9-6b56-5ac9-8abb-b8c1be617537","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ntsnver.pk9t04.n4zsbi0vab.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntsnver.pk9t04.n4zsbi0vab.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe5d7ebd-a3dc-5788-9f5f-a9f642325bec","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nidlog.40n0.uvtiwwmlrl.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlog.40n0.uvtiwwmlrl.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da3dc0c5-2523-5c71-9b40-271c2cf1a922","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nidlog.40n0.uvtiwwmlrl.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlog.40n0.uvtiwwmlrl.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82631256-ba8c-593b-bc62-318b49bfd59b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndocnid.da9dz.kpq8p1t81e.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocnid.da9dz.kpq8p1t81e.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb6fa8db-4cb9-5387-ae16-57a9e2d249eb","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndocnid.da9dz.kpq8p1t81e.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocnid.da9dz.kpq8p1t81e.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82e4e2fc-d349-5ba6-9a3d-388d12741ce1","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"tdoc.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tdoc.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0af12261-5740-57c4-a966-4f78cc584596","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://tdoc.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tdoc.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d7250a5-bbcb-563f-94a8-4215961a9754","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"0jr87375qt.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '0jr87375qt.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--924d6e5a-edae-535e-be30-b47ac307facb","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://0jr87375qt.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://0jr87375qt.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a228e70-5804-5328-93b3-7adf39399012","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"xblhfkri2q.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xblhfkri2q.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69bb324e-e5da-5435-8b1f-a7b3b3f2f77a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://xblhfkri2q.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xblhfkri2q.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--021332f1-ef2d-5491-a925-a57e95c4e988","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"r461wn14u1.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r461wn14u1.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fef4605f-6b29-5818-912a-061875f9a0bb","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://r461wn14u1.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r461wn14u1.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e954d96f-f9df-54d8-b21c-94a2fe149266","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nj1oayuy2o.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nj1oayuy2o.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--453045bf-b4cf-5b6e-a956-c9a1f17f3566","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nj1oayuy2o.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nj1oayuy2o.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c3b10b4-7b0b-5494-a70a-b05d46cf6e4c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"wgjngrxokv.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wgjngrxokv.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38a34058-5746-5cfe-ad8f-8800ef4d7e3c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://wgjngrxokv.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://wgjngrxokv.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11270484-31ba-5631-93d8-ef4bd93bf462","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"health-doc.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'health-doc.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af8fea33-e094-5b16-81c3-0cc536cd5600","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://health-doc.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://health-doc.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7e5f062-4acf-5f77-9c72-7d11cd03eb33","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"tahpuoto94.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tahpuoto94.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c127c51d-c702-5196-b5ff-17e56037ff73","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://tahpuoto94.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tahpuoto94.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7e98dfe-4e65-5a93-b7f5-2660f01c35ab","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"z330woigb3.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'z330woigb3.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fb59a7a-aa2b-50fa-8382-242640cc7e31","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://z330woigb3.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://z330woigb3.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72fb7a18-617c-5c51-b783-30f0a35af3f5","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"egbzqa25gw.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'egbzqa25gw.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d86eb879-5de1-5c5e-a4f2-4de276792455","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://egbzqa25gw.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://egbzqa25gw.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--555c33a1-a00e-59ec-bfb6-908a8894deef","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"aji1dfsici.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aji1dfsici.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f1d4a08-5fd6-5b2e-bc79-574ea77baf90","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://aji1dfsici.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://aji1dfsici.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a42b1805-f4ed-5db9-bc78-0f5634391314","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips-nid.9ddkd.aji1dfsici.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-nid.9ddkd.aji1dfsici.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74cb1edc-28a3-5ddc-adbf-4e0c3adb5782","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips-nid.9ddkd.aji1dfsici.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-nid.9ddkd.aji1dfsici.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dc45d10-db79-5f0e-bafd-923689841e6e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"u4bhx3zo39.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u4bhx3zo39.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41a4cc8f-fee2-5499-ab9c-8a665b741d3a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://u4bhx3zo39.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u4bhx3zo39.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--378a8b4d-b74a-523f-adba-71ce1f3c4a7c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"x6nnfysecw.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'x6nnfysecw.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d41bc3ad-6888-509e-af3a-3c5882b6f6c3","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://x6nnfysecw.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://x6nnfysecw.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f2a4947-aa3d-556b-8b93-8479eb7f2c98","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nkagtncqah.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nkagtncqah.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33c71c7e-77c2-5626-b449-aca2565eba1c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nkagtncqah.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nkagtncqah.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4f1df10-298f-5aee-b67a-62641b7afa7b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"2ecy51395u.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '2ecy51395u.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec31d4c0-45cf-5200-b73a-7d89f8b547c4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://2ecy51395u.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://2ecy51395u.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcbcac6c-c514-5ef1-844b-85c7d15a5e41","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"v3i2rde2y5.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v3i2rde2y5.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97c2f5e5-563c-5af9-be24-047502b3bf27","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://v3i2rde2y5.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v3i2rde2y5.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48f3e052-266a-5a4f-a21a-0e0572ea377d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"x1prl5k1a2.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'x1prl5k1a2.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--923b1b19-9ec4-55e4-aeeb-827819b365ed","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://x1prl5k1a2.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://x1prl5k1a2.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--118861e2-593f-5a10-b0d7-73fa642c1c79","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"jbyaa6xotk.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jbyaa6xotk.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66bde029-200b-522a-a0c0-ac2e9f3fd633","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://jbyaa6xotk.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jbyaa6xotk.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80f41d6b-1d35-5d92-9e66-a618be5a231f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"pzyyckwlqm.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pzyyckwlqm.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--522473e2-f256-5204-adc5-83af32504227","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://pzyyckwlqm.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pzyyckwlqm.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f959b2fe-47f6-5f01-8844-1e2ab66c04d3","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"qlrkm553jk.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qlrkm553jk.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35c8f1ac-ab5d-5f5e-8e6d-7e2f4b8f237f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://qlrkm553jk.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qlrkm553jk.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10034db7-ddb2-5ab2-b6a0-5b6ba3261d24","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"0g25r94p96.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '0g25r94p96.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c4f5d79-83e0-5246-a018-beb6a36b993b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://0g25r94p96.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://0g25r94p96.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--855befd9-90fd-55c8-9456-bb765bea9414","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndoc-deliver.i6u25s.i0bdvsseci.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc-deliver.i6u25s.i0bdvsseci.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35598355-4102-529a-934d-138e0a54d2f8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndoc-deliver.i6u25s.i0bdvsseci.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc-deliver.i6u25s.i0bdvsseci.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83128658-f903-5bbd-9916-93cc957de892","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"i0bdvsseci.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'i0bdvsseci.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--841122c4-d816-58dc-86e5-cec84247d68d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://i0bdvsseci.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://i0bdvsseci.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3afaab5-e00b-5217-9db9-a22be665d42b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"qqdfhtrhlv.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qqdfhtrhlv.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dfb1cd9-3063-50d3-99b5-ecfb8485f172","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://qqdfhtrhlv.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qqdfhtrhlv.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5cb3ad3-536e-5c80-b45a-f1b0cf42b9b2","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nusrauth.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nusrauth.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c7bc780-8f63-5c3c-827a-dd274ce12166","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nusrauth.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nusrauth.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67317ba7-fc39-564d-9610-aac741ba14a5","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ipmo.loseyourip.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipmo.loseyourip.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--144959b2-6ee5-5973-b97f-244c473d9264","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ipmo.loseyourip.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipmo.loseyourip.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ce50a41-a749-57a8-ab51-ec0bb1a67772","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"lopm.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lopm.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bd9b372-9fb4-58ad-872f-0441e259e9ef","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://lopm.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lopm.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6142e88-00a5-5713-b673-69388f80a55d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nts-write.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts-write.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37d70842-1af9-55a1-b13f-23e23c8d0817","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nts-write.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts-write.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34b332b7-b418-51c5-801e-a61945818ad8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"passnid.lopm.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'passnid.lopm.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e31a498f-d300-5b19-9217-928729c225ad","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://passnid.lopm.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://passnid.lopm.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6c27901-3f3d-59ef-aa47-5bc845816acd","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"invoice-doc.camdvr.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice-doc.camdvr.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02678675-395b-5f82-a8ab-5d685aa2472f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://invoice-doc.camdvr.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice-doc.camdvr.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3398994d-2a6c-5890-a642-8026957d96f2","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"biodn.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biodn.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0519208e-9ef8-5f39-9c4f-32d4f3d42fb8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://biodn.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://biodn.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5aaa118-3a46-59f7-b5ca-0cc263836dd4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ppoulink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ppoulink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da1fd755-d859-5367-b176-b63d348d5bb8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ppoulink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ppoulink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41eccddd-08a0-5c7e-b1c7-62663123c850","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"river-connect.ddnsguru.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'river-connect.ddnsguru.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ff19bf7-3ca1-55c0-ab07-c006218c6431","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://river-connect.ddnsguru.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://river-connect.ddnsguru.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73f77d80-7870-5068-a18d-abe2dfbc0ff1","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndoc-void.kozow.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc-void.kozow.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9837b91d-99ae-54e1-a762-9eb48be90107","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndoc-void.kozow.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc-void.kozow.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53b56074-60e7-512e-bd59-c41407ebfddf","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"host-nid.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'host-nid.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08393005-11da-52f0-859c-b00f7891ff4a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://host-nid.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://host-nid.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15171cd2-d23f-5d3c-877f-06d1378f9e3d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mybox.camdvr.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mybox.camdvr.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b57549a-a063-5f72-981d-831ecfd39d0f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mybox.camdvr.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mybox.camdvr.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d639f026-0cd2-5771-8407-fa785a12e4bd","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"moisguide.ndoc-void.kozow.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'moisguide.ndoc-void.kozow.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b95d36c-4ad1-5570-82f4-73d21246d474","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://moisguide.ndoc-void.kozow.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://moisguide.ndoc-void.kozow.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76c0637f-6640-56e4-928f-e97a2ff45d5f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nav-log.moois-nid.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-log.moois-nid.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5ac6261-edfb-5e3a-87f4-801c2ce13fc7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nav-log.moois-nid.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-log.moois-nid.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d5afd0f-ae7a-51c6-b12a-42f69690aade","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid-nver.mybox.camdvr.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-nver.mybox.camdvr.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43c92238-36fc-505f-8108-3bb15e3c2fd8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid-nver.mybox.camdvr.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-nver.mybox.camdvr.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3a2fe62-348a-512a-824b-abfb618dd695","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ispd.nts-write.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ispd.nts-write.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f61140c1-a506-566b-9fe7-bc9828d5ab71","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ispd.nts-write.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ispd.nts-write.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab9ffbca-17ae-5313-b87d-6f769da822fe","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ipcp.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipcp.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f86c63a-f90d-5cb9-b035-d4f4ddf8d0d5","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ipcp.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipcp.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6ccaf05-ba9f-505c-b856-74f2b544b468","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ntt-suggest.host-nid.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntt-suggest.host-nid.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4a9afbe-2e99-54c0-87d5-d631b332085c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ntt-suggest.host-nid.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntt-suggest.host-nid.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03bb007a-44d9-5bdc-aae6-f41d262d581a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ntt-suggest.river-connect.ddnsguru.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntt-suggest.river-connect.ddnsguru.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b3ca77-9d43-5930-817b-7401cea4ad63","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ntt-suggest.river-connect.ddnsguru.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntt-suggest.river-connect.ddnsguru.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5195c3b-659d-5892-8f0b-691ff5d3f16f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mois-doc.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois-doc.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8e719cf-31f4-560f-97d5-e8e78c527df1","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mois-doc.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois-doc.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8e4bb65-9a77-57b1-8f7c-3a4af1664f4b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips-doc.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-doc.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5fb2cf1-53d5-5a1c-806c-51d83bcbe4e9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips-doc.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-doc.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--211e8cbc-cf08-55ab-8291-1b9befd3bb7e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"confirm1.moois-nid.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'confirm1.moois-nid.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fda4a101-4d23-5be0-a16b-5af1be1b23e0","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://confirm1.moois-nid.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://confirm1.moois-nid.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adbb0802-d799-518d-ad7d-c0eb6d20786d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.ips-doc.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ips-doc.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1e36c1e-73bf-59e4-943d-630c78f5ae14","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.ips-doc.webredirect.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ips-doc.webredirect.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce3ee39b-7e8e-5003-abf8-382f055c3a4b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips-check.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-check.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ca8c4dd-2e31-57b0-bc72-d8e15a07b391","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips-check.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-check.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5b42d0e-7720-57d7-a742-3a242739eba6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"moois-nid.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'moois-nid.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9155a887-ee6a-5be5-aac8-204079dd75fd","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://moois-nid.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://moois-nid.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc284624-a96a-5846-bfd9-d34e61e93455","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid-sign.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-sign.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72160039-3119-5aa6-8a91-3e96e74f1362","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid-sign.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-sign.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--969d9b4c-9600-5c3f-bb25-6488753bc95e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"naver-log.ddnsfree.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'naver-log.ddnsfree.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71dbcc31-e068-5f19-b61e-b119a2f9fca7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://naver-log.ddnsfree.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://naver-log.ddnsfree.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f882c67-e9f4-53c2-935b-03e366cd9b3c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nst.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nst.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bcd688b-bddc-5990-8a86-312b9b486272","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nst.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nst.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f251456-9b88-56b1-82fe-fa48847923e4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nav-log.ips-check.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-log.ips-check.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62d8408f-9fbb-52fe-a265-a69c1a1bbe84","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nav-log.ips-check.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-log.ips-check.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42e319d4-ff74-5749-8600-8825791574c0","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.nid-sign.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nid-sign.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1871616-a99f-5ac7-ad4b-2425b0d7a57a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.nid-sign.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nid-sign.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f89ff4a-aeb4-5b98-b302-13e23e37e5e4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"r8mcc7z7jb.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r8mcc7z7jb.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--274008e8-035e-5b87-a4e7-00174eeffec8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://r8mcc7z7jb.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r8mcc7z7jb.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--200a8a3b-97d8-580a-9238-d46cabf205d9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"support.nst.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'support.nst.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c32bea7-9b18-54b2-8769-2130dfcb576c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://support.nst.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://support.nst.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc6c9554-8bb8-5e8d-aeff-265a8d29025a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"info.naver-log.ddnsfree.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.naver-log.ddnsfree.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a37e580b-64cf-59a3-ad35-12a8e33593b6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://info.naver-log.ddnsfree.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.naver-log.ddnsfree.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ada82eeb-371b-529b-bfd4-8a41c017d393","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndoc.nid-sign.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc.nid-sign.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--974a9946-80e3-5d4d-8945-2dd2563a7377","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndoc.nid-sign.opik.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc.nid-sign.opik.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--759d145c-a10a-5f7e-9bd3-53267d82e9ad","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"bux-nid.ips-go.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bux-nid.ips-go.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a27d6659-f7c7-50ed-90ef-ba4708ac69df","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://bux-nid.ips-go.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bux-nid.ips-go.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a55e25b-decc-5694-847b-a9aee4676577","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"pc3vq8gte2.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pc3vq8gte2.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0595ed3a-227d-5b15-b8c6-6f9e09ff108b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://pc3vq8gte2.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pc3vq8gte2.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d501e9b-1bb2-5b99-bfda-11bd21b64f1c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mail-check.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail-check.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8536a222-36b6-5cf8-a55b-ef0e14545292","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mail-check.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mail-check.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a44758d2-2322-5160-bdc1-b1d1b73fc300","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mois-go.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois-go.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30205027-eabe-51e7-99ae-9e0445e3259a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mois-go.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois-go.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfcaa93c-7cd2-5d9d-a77c-6918299df64a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ms-cloud.ezgateway.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ms-cloud.ezgateway.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--222f8679-a32e-5502-b339-d1973401e105","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ms-cloud.ezgateway.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ms-cloud.ezgateway.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--810141f4-ffae-551f-b109-1edf5ad65e7d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"o73nn803g2.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'o73nn803g2.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72d873ab-6b1f-5249-97e7-3273ac7452ae","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://o73nn803g2.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://o73nn803g2.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f354c26-6152-50e4-ac95-ab436ad8de7c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"8mko81k7tf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '8mko81k7tf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2621674-6f60-52fc-839c-460eec656abb","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://8mko81k7tf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://8mko81k7tf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb34743a-f549-5e8d-99f4-29e56ba8d173","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"kl1j9dkiy7.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kl1j9dkiy7.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2ae176b-3595-55b0-9c65-f8aa33da4809","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://kl1j9dkiy7.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kl1j9dkiy7.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e89d1d79-1871-516f-b7fb-f14a4c2912a9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"info.mois-go.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.mois-go.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3f7fbf4-5f03-53d0-bf37-2678e09f45a6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://info.mois-go.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.mois-go.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e55f301-28b1-5748-90d1-c59f36e03afe","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"udoc-nid.freeddns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'udoc-nid.freeddns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e2b9650-12ab-52c2-8d56-aafd3282e289","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://udoc-nid.freeddns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://udoc-nid.freeddns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c1a3691-d07f-553d-872a-8d3f56ee7e90","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips.dynuddns.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips.dynuddns.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2aef7e9-3816-5ed3-a49c-59018f891955","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips.dynuddns.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips.dynuddns.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d188d487-8d73-5d92-abb4-5214a8204382","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mois.mytunnel.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois.mytunnel.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f365fc-5fe4-59ea-a8ce-b9f2475be764","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mois.mytunnel.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois.mytunnel.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2580542d-f16b-5a6d-9b17-74a993cac48a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"niws.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'niws.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61af4386-494d-5a7f-b97f-9fa5a71b3bdf","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://niws.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://niws.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8957c49-60d8-5593-aa07-b391adcee3d4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nps-load.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nps-load.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d841a66e-f9b7-5288-8ca1-99e0450619e5","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nps-load.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nps-load.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b91434c-de5f-580c-b821-fa3bf4cc7b97","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"naver.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'naver.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17deddb4-288c-5829-94ec-d7b6ec1111f7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://naver.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://naver.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43354cc1-5f43-5238-b019-61821da5951e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.niws.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.niws.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--560204da-9785-5800-b468-dab17b198d5e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.niws.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.niws.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa1d9801-ae84-5367-9ed1-69d177133c4b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips-go.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-go.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6303a47-6709-5f40-beca-c2c9626965b2","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips-go.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-go.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea5f7c79-a4eb-5340-9fbc-7928ded7441e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndoc-stoke.accesscam.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc-stoke.accesscam.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07ab174e-e7e0-5150-b83d-732603b61b6c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndoc-stoke.accesscam.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc-stoke.accesscam.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af4c954b-8c77-56c5-a8ac-8d69648547f9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid.naver.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.naver.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3005ac5a-6a3f-5279-be2e-1ee538803943","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid.naver.mywire.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.naver.mywire.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4e4cf45-7526-54e7-9fa8-110f08c59320","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mtf-nid.ips-go.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mtf-nid.ips-go.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ef873a0-27bf-57b8-ab87-75347b1a86a0","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mtf-nid.ips-go.gleeze.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mtf-nid.ips-go.gleeze.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb7713ab-1e06-524a-bcad-a5c4f14e1272","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"info.dns-setup.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.dns-setup.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76a8a63f-8cc0-54db-8a58-a029509c2785","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://info.dns-setup.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.dns-setup.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83282032-d8d8-5ba5-a3a6-2253a638f7ed","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"uxk-nid.nps-load.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uxk-nid.nps-load.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fe4f94f-ea42-50ef-8b95-0d22dad85941","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://uxk-nid.nps-load.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uxk-nid.nps-load.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--783b736b-9519-5f55-a5ec-3878e524b7b4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"dns-setup.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dns-setup.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa92c356-64c3-5c2c-b36f-1a659629f80b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://dns-setup.remotewire.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dns-setup.remotewire.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15234904-92af-588f-a68a-c11357d10d43","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ip-cloud.theworkpc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ip-cloud.theworkpc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f93ffb34-2595-54fd-bafa-c136c5623fca","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ip-cloud.theworkpc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ip-cloud.theworkpc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64c3dfeb-1156-538e-aa11-d529b4b512ed","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"5jeqr9bf89.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '5jeqr9bf89.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--090009c0-8a43-50b9-86ae-e94d2e9afe32","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://5jeqr9bf89.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://5jeqr9bf89.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e3cf504-e8f3-5648-8a0b-a378ea3516a0","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"d0vtzpoxyw.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'd0vtzpoxyw.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8af929a0-b567-5907-870d-6a03ed394183","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://d0vtzpoxyw.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://d0vtzpoxyw.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e201b67-9064-5e63-b406-24697b85c9c9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"cxmfcubfnq.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cxmfcubfnq.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--038d19f6-51b8-5f02-87b4-faa1d80554f6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://cxmfcubfnq.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cxmfcubfnq.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4840a40c-9ee0-5267-8f23-89020c078e7a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"n2gdnw08p4.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n2gdnw08p4.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff62f0a5-1243-5c14-85a5-c6342cd610fa","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://n2gdnw08p4.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n2gdnw08p4.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--023ce7a9-c3b3-5c12-88a6-ceee47459c7a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"b8fq9189g6.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'b8fq9189g6.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3af2b2b0-5f69-5838-830e-ecf69f7adab7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://b8fq9189g6.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://b8fq9189g6.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d343c55-d7e5-5440-be2b-7992ebbbff9a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"4vkc4fdduf.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4vkc4fdduf.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22d6eb22-d018-5a5f-85eb-a4b95b372ff4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://4vkc4fdduf.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4vkc4fdduf.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b68b89f-d7de-5105-b4ec-93677aed129f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"diaxwn61lp.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'diaxwn61lp.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ece8f9a-4e82-51e1-89e1-752be04a5eac","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://diaxwn61lp.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://diaxwn61lp.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6d3fd05-2cc8-54d9-bd5f-ac3fef47bb25","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"g7slrbjt7j.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g7slrbjt7j.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d251f575-a093-5c41-b332-445074be949c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://g7slrbjt7j.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g7slrbjt7j.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a82e764-7da4-5c16-84ea-d54652a8e874","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"acaiqb90ql.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'acaiqb90ql.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fcaa199-7d65-5f66-98b8-7e32b4130860","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://acaiqb90ql.v6.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://acaiqb90ql.v6.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54123f57-beca-5ac7-989f-9d16ef27d885","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"securenid-hqj.ips-nav.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'securenid-hqj.ips-nav.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41217ef1-5de7-51a1-9520-fb1d2a506af1","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://securenid-hqj.ips-nav.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://securenid-hqj.ips-nav.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--296d103c-1d25-5787-aedf-c92b2707bc89","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips-nav.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-nav.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f1e1649-763c-5c3b-a0f0-3dc505a79992","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips-nav.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-nav.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dd0fc50-2573-50b3-ad61-8311f99de916","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"redirect.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'redirect.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd9e84e3-0417-5bcf-a9de-51c9bbd6ace3","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://redirect.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://redirect.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055356418161582588"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e7d122a-ca90-5d8f-a0ac-0d0bc1c7168e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"doc-load.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc-load.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9b7beb6-2e82-5ccc-845c-cc017280c512","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://doc-load.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc-load.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e88e173d-718f-5380-afed-f41f3424a173","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"user-info.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'user-info.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48c4e39b-45fc-5d03-b9b5-1f5fb5cf44b1","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://user-info.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://user-info.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c2b0cc4-9d38-5c8b-a91e-b4c60583e387","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mois-go.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois-go.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--657b40b7-836e-572a-8763-c7cc2a0283b2","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mois-go.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois-go.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc3628f6-a865-5d41-abb1-7ceaf065d16e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"km-link.mois-go.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'km-link.mois-go.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f31c2058-1054-5bb0-a775-bba48a049955","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://km-link.mois-go.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://km-link.mois-go.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5bdb60d-e298-528c-bb56-cfd9e8d396dd","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips-co.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips-co.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4e3981c-e3b9-5374-9a78-1a59acd4f25d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips-co.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips-co.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f73fbf75-98ca-57b2-9abb-8708e8cb04dd","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"checkinfo.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'checkinfo.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0ab28eb-b798-5dee-b402-9965fae9113e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://checkinfo.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://checkinfo.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3afba1f0-7be4-5492-a21c-ec9948f49703","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid-support.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-support.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35dbbf35-c3df-5b30-a0e8-dd145e84e2b7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid-support.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-support.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d9daed9-f5aa-50c8-b397-438457fddb5c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"infocheck.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'infocheck.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0941a95-9cf8-564f-8808-f1ef6956f6ab","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://infocheck.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://infocheck.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e1b1d56-c919-5044-bd6c-515ca1683388","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid-auth.infocheck.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-auth.infocheck.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16764a5e-6cb0-5ca2-90b7-ffc6ab252983","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid-auth.infocheck.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-auth.infocheck.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abac45bd-3104-5fda-9bde-1963559e531b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"passkey.mail-check.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'passkey.mail-check.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e23eae4-9a16-5ed2-896b-6f62dd4f9ce7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://passkey.mail-check.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://passkey.mail-check.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7a37c70-8d7e-5ee3-b4b6-157c92b203f6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"stepverify.mail-check.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'stepverify.mail-check.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1ba15db-3cc3-5d7a-89f5-cce68846f05a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://stepverify.mail-check.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://stepverify.mail-check.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8292ef5-139c-5a12-b177-55ca8255b662","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"doc-nid.strangled.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc-nid.strangled.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--643e9b4e-bf10-5e4b-be87-1398e83834df","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://doc-nid.strangled.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc-nid.strangled.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eaa4f69-58be-5ffd-8729-399dcc1e9848","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mail-check.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail-check.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97b2df8f-2cd7-54df-b257-a380a2ef6d2b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mail-check.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mail-check.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68524f44-98f9-51ab-9b5b-493c1c674375","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mail-check.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail-check.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d69201c5-caee-5948-ba1a-686dff56e16d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mail-check.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mail-check.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afd8081a-6d4e-5319-9d0f-80680edef3a5","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ndoc-auth.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndoc-auth.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a20f4e3-ee33-50b1-bb73-14d74dda941d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ndoc-auth.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndoc-auth.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c010e47-22ee-5a1d-9f6e-7985195e782f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ntauto.a8492.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntauto.a8492.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--159a8b91-0acc-5dfd-8596-424cf39752f4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ntauto.a8492.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntauto.a8492.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b58f64fe-8c0a-560d-92f0-9ae4932631a7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mghtx.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mghtx.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f1675d-31d6-524e-9abe-bdcc224cea05","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mghtx.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mghtx.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d95038fa-153a-5608-a73c-fb52ea2d42e5","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"hqu.nid.user-auth-manage.n-e.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hqu.nid.user-auth-manage.n-e.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32d6c059-4266-56d5-99ba-eb30542ab5d2","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://hqu.nid.user-auth-manage.n-e.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hqu.nid.user-auth-manage.n-e.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--669c7c05-1dda-5645-b7b0-c9f158ff7998","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"fpf.ips.user-auth-manage.n-e.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fpf.ips.user-auth-manage.n-e.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--888003c8-63dc-5b46-96bf-55678c14a80f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://fpf.ips.user-auth-manage.n-e.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fpf.ips.user-auth-manage.n-e.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f300a0b-fefa-5e23-8ab6-bdd5af284c41","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ips.petfoodkorea.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ips.petfoodkorea.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b38b162-0e56-5f5b-acb2-3c4782abc622","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ips.petfoodkorea.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ips.petfoodkorea.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--817c8745-da1b-5c7e-a993-421c7ce4f2ff","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ikx3xd04mj.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ikx3xd04mj.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f98a1eaa-96a5-54fd-80c8-1591623f4d9f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ikx3xd04mj.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ikx3xd04mj.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d123c4a3-7c38-5c04-8ae9-9ac9ff6a266f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"9im8wurhzo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '9im8wurhzo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b02ab8b-7c82-5680-a0ba-b6d6dc869382","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://9im8wurhzo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://9im8wurhzo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--820f189a-8ba8-5f73-9888-9c68c4a4b90c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"mdmfdu21lh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mdmfdu21lh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea8a2996-ff2a-5b7e-acac-f64bd1b1638b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://mdmfdu21lh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mdmfdu21lh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76cb6364-0983-5def-adde-b07270fc59d9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nkfumxgqxd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nkfumxgqxd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b49467ed-4a3d-50ec-bba4-85201e85e92a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nkfumxgqxd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nkfumxgqxd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3928c788-f5c5-5514-88aa-f5f2a9a15100","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"omra9yg7k1.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'omra9yg7k1.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--586b866d-d22d-56b6-a9fb-2325637d6229","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://omra9yg7k1.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://omra9yg7k1.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ceb6b29-b4cc-5ed2-8b37-f779dbdfb912","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"o9ziq78shg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'o9ziq78shg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbaada30-9130-5a4e-bb4f-0b3b21353ae8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://o9ziq78shg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://o9ziq78shg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--758aac13-9b5c-515c-bc85-8373fd1e2aa9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"qx7k2ju0qc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qx7k2ju0qc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5a3c07e-482d-590f-a5c5-18057daa4256","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://qx7k2ju0qc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qx7k2ju0qc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a938667e-7ef5-502b-b1ae-2c1d6c846081","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"0c50zrvnoi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '0c50zrvnoi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8a0c5f1-e7ed-5533-be3e-06043027c9a6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://0c50zrvnoi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://0c50zrvnoi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b70933d9-6f03-53e7-bf4d-ec44af0c2656","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"net-security.3by9m.0c50zrvnoi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'net-security.3by9m.0c50zrvnoi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dd8ea28-e2d5-5a29-95d3-1cd104c9eb88","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://net-security.3by9m.0c50zrvnoi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://net-security.3by9m.0c50zrvnoi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8743bdfd-a4d8-52c3-8262-21c864d44c3b","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"net-security.05c0.nkfumxgqxd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'net-security.05c0.nkfumxgqxd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91545e48-558c-526d-950b-1f6dec140a29","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://net-security.05c0.nkfumxgqxd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://net-security.05c0.nkfumxgqxd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90111d04-3ea8-5819-b59e-22b9731f3116","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"net-security.xj9kys.omra9yg7k1.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'net-security.xj9kys.omra9yg7k1.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9172f7d8-8d67-58ce-aab5-6ebf20681f73","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://net-security.xj9kys.omra9yg7k1.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://net-security.xj9kys.omra9yg7k1.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a7bbc1c-251a-5041-95d7-5ded8c57cc3f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"guid-nid-authentication.h9xyka.o73nn803g2.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'guid-nid-authentication.h9xyka.o73nn803g2.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75bfe802-2b5e-5403-84e3-b90a49e4cb7a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://guid-nid-authentication.h9xyka.o73nn803g2.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://guid-nid-authentication.h9xyka.o73nn803g2.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ce99bff-d124-51dc-b611-744db38e2a6f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"jzeyutudey.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jzeyutudey.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e3b829d-7eea-53df-a90d-aacbcb48daa8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://jzeyutudey.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jzeyutudey.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a81e216c-1871-592e-8db5-0365dc026c1e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"ls31y9be8d.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ls31y9be8d.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44169fea-e239-50ff-b13b-57cb5b01e690","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://ls31y9be8d.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ls31y9be8d.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1bff524-abb5-5f63-bd58-2ffbaf2d619a","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"link-connect-naver.fcol.ls31y9be8d.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'link-connect-naver.fcol.ls31y9be8d.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a6207fe-a8b1-5722-aed5-658164f1a85f","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://link-connect-naver.fcol.ls31y9be8d.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://link-connect-naver.fcol.ls31y9be8d.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f87516f-4e59-5a8d-adfa-beb6bd8be9e5","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"l37g2l5nrx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'l37g2l5nrx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cc2335a-7f2d-589a-8a47-07e90a24a6f1","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://l37g2l5nrx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://l37g2l5nrx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e931a233-e613-576d-a8e7-fce4413998f6","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"g4os5r9e8c.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g4os5r9e8c.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2dbabdc-ea45-5f5c-8b77-b6415a5b5609","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://g4os5r9e8c.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g4os5r9e8c.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f9287ed-a299-53fa-834d-b514374d8c9c","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"direct-auth.bns7a.8mko81k7tf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'direct-auth.bns7a.8mko81k7tf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ae699d7-587b-51da-8f45-74623744f769","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://direct-auth.bns7a.8mko81k7tf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://direct-auth.bns7a.8mko81k7tf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5d91df1-eeef-53d9-a277-f29fc48e5cfd","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"4ub04p5i10.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4ub04p5i10.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab465f2a-7f3f-51dd-b1d5-f607bcc60cea","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://4ub04p5i10.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4ub04p5i10.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16cac678-5d41-5a0f-92bf-b596719cd325","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"v5f6rd4lwz.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v5f6rd4lwz.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--585546a5-b3d1-5edb-819a-64fda45ae571","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://v5f6rd4lwz.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v5f6rd4lwz.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2fca005-cbe6-5ebb-8d25-3739eff324ef","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"rqs2t5hbzf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rqs2t5hbzf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--576ca533-c713-54de-b5f4-40fc4f475a33","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://rqs2t5hbzf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rqs2t5hbzf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5de788b4-9070-59a3-bdcc-dde129f0ffc7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"75bx4qm42u.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '75bx4qm42u.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99bc5874-1b31-5164-9421-ee4451f7e1df","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://75bx4qm42u.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://75bx4qm42u.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e98775c-e62b-54d7-b29b-09138943e7a2","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"nid-auth-invoice.64rp5.kl1j9dkiy7.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-auth-invoice.64rp5.kl1j9dkiy7.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06ec3181-faac-517e-b2f3-fe0ebf73a9b7","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://nid-auth-invoice.64rp5.kl1j9dkiy7.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-auth-invoice.64rp5.kl1j9dkiy7.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae770bcf-6b05-5e0c-a901-bf6acc299016","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"tax-guide.f29pvq.v5f6rd4lwz.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tax-guide.f29pvq.v5f6rd4lwz.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--430c4054-aaa8-5d9d-be11-875eef4321f4","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://tax-guide.f29pvq.v5f6rd4lwz.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tax-guide.f29pvq.v5f6rd4lwz.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18801b4e-0e71-59a9-a3ac-87b29c508e93","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"tax-guide.hazgs.rqs2t5hbzf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tax-guide.hazgs.rqs2t5hbzf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0925f6c-1097-5458-8ec1-1b13dead4cdb","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://tax-guide.hazgs.rqs2t5hbzf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tax-guide.hazgs.rqs2t5hbzf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61101134-c659-50a0-bf39-16a50ef9a9ae","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"1one6il0oe.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '1one6il0oe.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7a1560b-4ea0-56f2-a1fe-72b502619659","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://1one6il0oe.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://1one6il0oe.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b072c46-0e9d-51f8-8f04-09392af169b8","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"tax-guide.zl0s4v.75bx4qm42u.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tax-guide.zl0s4v.75bx4qm42u.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7785fd61-8f97-5189-9d58-fd5ad4658d06","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://tax-guide.zl0s4v.75bx4qm42u.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tax-guide.zl0s4v.75bx4qm42u.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aa4364b-eb67-5f49-a963-22b44b1a8e0d","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"tax-guide.ttl2.rqs2t5hbzf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tax-guide.ttl2.rqs2t5hbzf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8d160fc-926f-5da3-8de9-1a0386179110","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://tax-guide.ttl2.rqs2t5hbzf.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tax-guide.ttl2.rqs2t5hbzf.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0eae3de-340f-547e-b070-01bf96089426","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"w18b1g7c1o.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'w18b1g7c1o.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86d9b81a-75f8-53b3-8ffa-56e114748ec9","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://w18b1g7c1o.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://w18b1g7c1o.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84a1aeff-28da-5a8f-b70e-506311959067","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"kpxkeugpi6.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kpxkeugpi6.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--842bcca6-38cc-5c91-acca-1f2908d02f44","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://kpxkeugpi6.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kpxkeugpi6.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e35a9049-89f2-5a47-8ed2-3c53bf37002e","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"http://123.58.201.222","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://123.58.201.222']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--691f3abc-9833-574a-9978-3d3ac0263c59","created":"2026-05-15T18:35:00.000Z","modified":"2026-05-15T18:35:00.000Z","valid_from":"2026-05-15T18:35:00.000Z","name":"123.58.201.222","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '123.58.201.222']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050659775428337786"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fc496e8-267a-5b51-9921-f3c9ae09b7d2","created":"2026-05-15T18:43:00.000Z","modified":"2026-05-15T18:43:00.000Z","valid_from":"2026-05-15T18:43:00.000Z","name":"sicuro.portale-ledger.com","description":"IOC reported by @vxdb on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sicuro.portale-ledger.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/vxdb/status/2055358426654343498"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5d6d540-bfd0-53d0-b7f9-2a67fc625b10","created":"2026-05-15T18:43:00.000Z","modified":"2026-05-15T18:43:00.000Z","valid_from":"2026-05-15T18:43:00.000Z","name":"http://sicuro.portale-ledger.com","description":"IOC reported by @vxdb on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sicuro.portale-ledger.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/vxdb/status/2055358426654343498"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2b84700-008e-5c17-b273-a20e730a0ece","created":"2026-05-15T18:43:00.000Z","modified":"2026-05-15T18:43:00.000Z","valid_from":"2026-05-15T18:43:00.000Z","name":"qr.scansione-ledger.gl","description":"IOC reported by @vxdb on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qr.scansione-ledger.gl']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/vxdb/status/2055358426654343498"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--24dc9eef-9735-5126-80e5-4ef4a716e24b","created":"2026-05-15T18:43:00.000Z","modified":"2026-05-15T18:43:00.000Z","valid_from":"2026-05-15T18:43:00.000Z","name":"http://qr.scansione-ledger.gl","description":"IOC reported by @vxdb on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qr.scansione-ledger.gl']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/vxdb/status/2055358426654343498"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--490aaf36-c766-548e-b22b-82f9835e3a9f","created":"2026-05-15T20:00:00.000Z","modified":"2026-05-15T20:00:00.000Z","valid_from":"2026-05-15T20:00:00.000Z","name":"09474br.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '09474br.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055377717768462486"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec906359-8142-564c-885c-03fdf311c0ff","created":"2026-05-15T20:00:00.000Z","modified":"2026-05-15T20:00:00.000Z","valid_from":"2026-05-15T20:00:00.000Z","name":"https://09474br.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://09474br.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055377717768462486"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5bd4bc5-d8ae-5403-aabf-bd14a60bf126","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://67.209.179.189","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://67.209.179.189']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a91f80cf-0a45-5845-817c-2ac9acd02f94","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"v52e.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v52e.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41fc3adb-5d4b-534e-958a-abac8a09b77d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.v52e.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.v52e.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0795e3ef-ac8a-5a20-a851-768ce3499068","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"y28s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y28s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79cedf83-9cf8-5565-8696-0bd3517253b9","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.y28s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.y28s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deb18f3e-5a69-5fde-b580-48c52f3309f6","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"g47t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g47t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--141da818-072c-52a1-870e-168597f9652b","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.g47t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.g47t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9e02302-ed37-50e8-9b6a-a4eb5f9665ce","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"j75n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j75n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6620da9b-3c38-5704-b512-672db5f4cdd2","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.j75n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.j75n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06cf4d52-acd5-5ae5-aac1-f301d6d45a8e","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"t34d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't34d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52f5cc80-bef4-5682-978e-ca1088b7f3b1","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.t34d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.t34d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fbbe286-2b12-5129-9af5-f47579400799","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"a86u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'a86u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4f7c13b-f300-586c-91fd-9a6cafc45805","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.a86u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.a86u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b14f156-37b8-5031-8c09-60235ebad290","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"k29h.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k29h.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76dc22d2-b577-50af-80f2-6c1e38035606","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.k29h.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.k29h.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a000c9de-4a89-5392-8d30-648fb1c8dc76","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"u28x.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u28x.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02dd9099-85a7-578c-ba02-d555b654c424","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.u28x.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.u28x.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8878e283-9592-54c6-83f1-67c02d0c3f5d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"z63k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'z63k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12449f96-dc58-504c-97ed-9f84b5b4bb9f","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.z63k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.z63k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9be099e-2b70-5862-b6c4-c88f27dea486","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"r45x.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r45x.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc875c71-b3bc-515a-9ac7-37111eefc8a7","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://r45x.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r45x.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f20f068d-bb9b-5c23-ba40-85d50d49b12a","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://a86u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://a86u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b92f1e5-f6f0-5375-b07c-d4d08a322be9","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://g47t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g47t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1e5dc6e-c094-5b24-9a39-553fce2072d4","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://t34d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t34d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84ca451f-8a86-5fc5-9747-f5173647fb3f","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://k29h.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k29h.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba0613f7-7170-5142-a8a5-3f5b337fbfc6","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://y28s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y28s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33694624-f74a-5247-aef0-544854528f53","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://j75n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j75n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4ea5e80-b434-5048-9b44-417250bfa65a","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"j82k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j82k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c19058d-822c-5d77-9d7d-f59a9d5447cf","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.j82k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.j82k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92e967d3-4400-5f10-ab31-537d05968471","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"j69t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j69t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6b540ad-ae5d-5a3c-a762-fa1014fa4e71","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.j69t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.j69t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d92c4383-39ee-5b28-b869-dc3f792ea4ef","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"j56y.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j56y.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d219f4d2-9364-5d40-9902-52a6f9f5b08f","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://j56y.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j56y.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba7527b3-e4c8-5794-b3d0-00e56f92b6db","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://j69t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j69t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b99a2089-aafc-5ad0-a87b-c56116e89620","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"r47b.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r47b.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4b82d7c-2694-540d-89c3-8df02e5ae462","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.r47b.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.r47b.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd933e21-d642-54f7-9f84-44ba1ab0f33f","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"p78t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'p78t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--695e4a2e-bf88-5f13-a620-e09d51610fc8","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.p78t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.p78t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d12fb16d-bea5-5a58-9ef3-902bcb81f9c3","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"j56y.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j56y.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1b6105f-a9a8-5265-9dcf-44f08f7aa445","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.j56y.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.j56y.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--007168d9-c1e7-5de1-a278-5769e5cccf32","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://z63k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://z63k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce0b0215-7b52-5a53-a6ce-0baaaf5fdcb6","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://j82k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j82k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44b57a02-646d-559e-b1b5-926d9bddd507","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://u28x.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u28x.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3287317-0816-50c6-851c-daeed976f724","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://r47b.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r47b.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a972f110-f025-5a6d-b505-d1f2b6139da9","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://v52e.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v52e.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1df3e60a-3000-54ad-b8fd-66f5b4bf245a","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"n58k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n58k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79f79daf-fb0a-53a9-b9bf-88f43a8d9663","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.n58k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.n58k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d84c6ea2-7c81-5f64-ab29-2bcf1f114362","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://n58k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n58k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f981f00c-c319-5daa-b76c-d321d6be14ff","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"j28t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j28t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--891648c5-b443-5ed6-be81-b61f54ad706b","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.j28t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.j28t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94d22e37-22d2-5604-b836-5c948c1946c1","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"v22a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v22a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30fc5647-d002-544f-96f1-a099c2e1c51b","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://v22a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v22a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d93714e8-89e2-522a-8c80-d92466681203","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.v22a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.v22a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--820a90a2-91e4-5eea-865b-69791f622533","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"y12p.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y12p.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aaad6be-2e40-528f-987d-306d06dfe4b2","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://y12p.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y12p.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a71afb6a-2878-5ef0-841f-8c8a9ddd4552","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.y12p.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.y12p.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--024f342b-c695-54a3-9a2a-35e8a992dce0","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"v42t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v42t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15ad7ec-3e94-5798-b19b-818548564fe4","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://v42t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v42t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0966bb3a-1518-5a66-9ede-0e6111f19fd0","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.v42t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.v42t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc55e36b-f358-5374-a503-10ef8c375b3d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"y66u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y66u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eff6e965-d9f6-5712-bc98-473b9137aefe","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.y66u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.y66u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd8de9b6-1e4e-5309-b7c3-744d97874f65","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://y66u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y66u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbe0e4a4-0fcf-5521-9188-b117b59bb55d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"s44n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 's44n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--597653fb-dd3e-572b-9ddf-48a3467baac1","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.s44n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.s44n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0833a69-4447-5128-859f-4dbee1693b2b","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://s44n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://s44n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76055abe-54c1-5d47-8fa2-2398ccc1c4c0","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"u84k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u84k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea8e85ce-36ba-516a-aa00-7fe0d6fdf182","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.u84k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.u84k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a890e500-89d8-5ec4-b938-0bedb264631f","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"g86d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g86d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d631018b-518f-509c-b283-a4b8e9fa14f7","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.g86d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.g86d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e246d41-a2ac-5aef-9a9f-a8392f5a4837","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"y29v.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y29v.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b5dd2fa-92fd-5a9b-ac65-8790bf4290fa","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.y29v.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.y29v.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f065b5de-ee47-59f7-bd12-aa9142eee523","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"b47t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'b47t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e275a2df-9447-53ed-a1ba-7f1ddacb8b2d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.b47t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.b47t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--516a6c73-94dd-5bd4-aa17-a69b82749b50","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://p78t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://p78t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53934beb-8fbc-5c6c-847d-6d37fdf89378","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"t45r.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't45r.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0ab0772-0588-5f6c-b6ea-3ffcdef921eb","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.t45r.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.t45r.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27a7e541-0793-57cd-acb5-1f217aaa89a6","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"g83u.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g83u.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--025fe281-a06d-5bc3-8941-90a9461d112b","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://www.g83u.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.g83u.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51fe5ebb-e971-5848-b0f7-3f64713e365d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://y29v.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y29v.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55eedca5-76d5-5ad8-8018-52eba0a1b264","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://j56y.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j56y.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12d658bd-4f12-50ef-83f0-5d34c2d13221","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://g86d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g86d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d6ca7a1-99db-5755-89fc-dbfc6420ba69","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"f28n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'f28n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e766c30-afb4-5431-a80b-ffb2f85e028d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://f28n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://f28n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d7d1d15-187c-5795-8f29-006d01c773d7","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://j28t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j28t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f76be1e-d34e-5549-b000-f977f2c3d3ab","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://t45r.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t45r.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--672aeb71-36e6-5a3a-bd96-7095da9bbb7d","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://g83u.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g83u.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1f76885-64b0-5941-ba21-18251cc058ac","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://u84k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u84k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8a69804-3441-59e7-ae43-f4fcf14386ad","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"67.209.179.189.16clouds.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '67.209.179.189.16clouds.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d91b872-5be6-5f32-98bd-0851cf5b3738","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://67.209.179.189.16clouds.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://67.209.179.189.16clouds.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--552c7c07-132f-513d-86ba-838b72eb4758","created":"2026-05-15T21:01:00.000Z","modified":"2026-05-15T21:01:00.000Z","valid_from":"2026-05-15T21:01:00.000Z","name":"http://b47t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://b47t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055393180346875928"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a712d0b-c794-5c04-95c0-279c38eeedda","created":"2026-05-15T22:00:00.000Z","modified":"2026-05-15T22:00:00.000Z","valid_from":"2026-05-15T22:00:00.000Z","name":"xxzxx8888888885654check.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xxzxx8888888885654check.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055407908175609918"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf6138c7-33a6-568c-8af3-3ed52bc9bd33","created":"2026-05-15T22:00:00.000Z","modified":"2026-05-15T22:00:00.000Z","valid_from":"2026-05-15T22:00:00.000Z","name":"https://xxzxx8888888885654check.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xxzxx8888888885654check.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055407908175609918"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc7bb7b6-744b-5898-b756-262aa679c3a7","created":"2026-05-15T22:49:00.000Z","modified":"2026-05-15T22:49:00.000Z","valid_from":"2026-05-15T22:49:00.000Z","name":"mhgvnye.bnihe.cn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mhgvnye.bnihe.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055420245729538461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52d4dda6-0daf-5362-a05d-e1027ae16d14","created":"2026-05-15T22:49:00.000Z","modified":"2026-05-15T22:49:00.000Z","valid_from":"2026-05-15T22:49:00.000Z","name":"https://mhgvnye.bnihe.cn/optmer-prefere_html/","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mhgvnye.bnihe.cn/optmer-prefere_html/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055420245729538461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--050bea6c-7528-5d24-8e04-c6af8a9ccd31","created":"2026-05-16T00:00:00.000Z","modified":"2026-05-16T00:00:00.000Z","valid_from":"2026-05-16T00:00:00.000Z","name":"authmail.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'authmail.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055438164307714140"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--229cf95a-8466-5eb4-9242-3ed2c9cf8be8","created":"2026-05-16T00:00:00.000Z","modified":"2026-05-16T00:00:00.000Z","valid_from":"2026-05-16T00:00:00.000Z","name":"https://authmail.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://authmail.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055438164307714140"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b886b44c-759e-503a-be6c-46f7345dff15","created":"2026-05-16T00:18:00.000Z","modified":"2026-05-16T00:18:00.000Z","valid_from":"2026-05-16T00:18:00.000Z","name":"http://101.53.233.153:53192/Mozi.m","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://101.53.233.153:53192/Mozi.m']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055442850322518455"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdb957b2-a7f2-5bf1-9264-6cac6434f6bf","created":"2026-05-16T00:18:00.000Z","modified":"2026-05-16T00:18:00.000Z","valid_from":"2026-05-16T00:18:00.000Z","name":"101.53.233.153","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '101.53.233.153']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055442850322518455"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4594accf-200e-5c46-8bf1-5cb3e17f07db","created":"2026-05-16T02:00:00.000Z","modified":"2026-05-16T02:00:00.000Z","valid_from":"2026-05-16T02:00:00.000Z","name":"officerep-servermailservicesdeskonlines.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'officerep-servermailservicesdeskonlines.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055468312838996127"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b8c7247-a496-50a1-b1a9-709555e85cf8","created":"2026-05-16T02:00:00.000Z","modified":"2026-05-16T02:00:00.000Z","valid_from":"2026-05-16T02:00:00.000Z","name":"https://officerep-servermailservicesdeskonlines.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://officerep-servermailservicesdeskonlines.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055468312838996127"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35d95a92-8892-5c9b-ba20-3ef66f038b8d","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"e-stat.9g4icuky.shop","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.9g4icuky.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d97aa104-58a4-5d9e-adc2-99f6c71a67d1","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"https://e-stat.9g4icuky.shop/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.9g4icuky.shop/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa863942-e058-5829-9f1c-d17bf9cbdadc","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"zx2517.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zx2517.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--950e37ab-a3bd-5514-a071-4e8884974caa","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"http://www.zx2517.com/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.zx2517.com/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71cdef08-550b-57f6-a5ee-3abff661e28a","created":"2026-05-16T04:00:00.000Z","modified":"2026-05-16T04:00:00.000Z","valid_from":"2026-05-16T04:00:00.000Z","name":"teieperformance.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'teieperformance.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055498523454451843"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a400fb0-51c7-5448-af87-4d2c0493b756","created":"2026-05-16T04:00:00.000Z","modified":"2026-05-16T04:00:00.000Z","valid_from":"2026-05-16T04:00:00.000Z","name":"https://teieperformance.com/app/zoNbHen3ed6ga32h9wfY25","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://teieperformance.com/app/zoNbHen3ed6ga32h9wfY25']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055498523454451843"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26c82982-4959-5334-b159-1e7f0060e7a2","created":"2026-05-16T06:00:00.000Z","modified":"2026-05-16T06:00:00.000Z","valid_from":"2026-05-16T06:00:00.000Z","name":"goodghyu.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'goodghyu.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055528719167488090"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf6f1fd7-67db-5c26-b3af-50c1f328a86c","created":"2026-05-16T06:00:00.000Z","modified":"2026-05-16T06:00:00.000Z","valid_from":"2026-05-16T06:00:00.000Z","name":"https://goodghyu.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://goodghyu.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055528719167488090"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8dbd989e-fbd1-5b7c-85cb-0ae6319e91c3","created":"2026-05-16T07:15:00.000Z","modified":"2026-05-16T07:15:00.000Z","valid_from":"2026-05-16T07:15:00.000Z","name":"31.7.61.61","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '31.7.61.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055547697864831203"}],"labels":["C2","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07b0cca2-b932-5d14-96bb-1a1a79587691","created":"2026-05-16T07:33:00.000Z","modified":"2026-05-16T07:33:00.000Z","valid_from":"2026-05-16T07:33:00.000Z","name":"e-uprava.gov-si.shop","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-uprava.gov-si.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055552087019114940"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e6646ff-6df8-5717-b0db-0fb3c1821926","created":"2026-05-16T07:33:00.000Z","modified":"2026-05-16T07:33:00.000Z","valid_from":"2026-05-16T07:33:00.000Z","name":"http://e-uprava.gov-si.shop","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e-uprava.gov-si.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055552087019114940"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a846156-29f7-5863-8619-9ebb3e9aec3d","created":"2026-05-16T08:00:00.000Z","modified":"2026-05-16T08:00:00.000Z","valid_from":"2026-05-16T08:00:00.000Z","name":"mett-amuske-olglin.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mett-amuske-olglin.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055558906462560478"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e7f39c5-cd69-5baf-8afb-0981c40a0d70","created":"2026-05-16T08:00:00.000Z","modified":"2026-05-16T08:00:00.000Z","valid_from":"2026-05-16T08:00:00.000Z","name":"http://mett-amuske-olglin.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mett-amuske-olglin.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055558906462560478"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--166c270f-93af-512e-9dde-e31349232728","created":"2026-05-16T08:51:00.000Z","modified":"2026-05-16T08:51:00.000Z","valid_from":"2026-05-16T08:51:00.000Z","name":"169.40.135.249","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '169.40.135.249']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055571912827556070"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f980936-c95f-5970-bfcc-06281f5bf508","created":"2026-05-16T08:51:00.000Z","modified":"2026-05-16T08:51:00.000Z","valid_from":"2026-05-16T08:51:00.000Z","name":"45.13.239.144","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.13.239.144']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055571912827556070"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96f6fd1-a07d-50d0-a760-f9291277ab94","created":"2026-05-16T10:20:00.000Z","modified":"2026-05-16T10:20:00.000Z","valid_from":"2026-05-16T10:20:00.000Z","name":"mem.calcuttaswimmingclub.com","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mem.calcuttaswimmingclub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2055594129216725110"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15352cd-2491-5d50-9ef1-de2c316bfc07","created":"2026-05-16T10:20:00.000Z","modified":"2026-05-16T10:20:00.000Z","valid_from":"2026-05-16T10:20:00.000Z","name":"https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2055594129216725110"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cee4f181-cb95-5929-8a31-67ad2b39f8d4","created":"2026-05-16T11:22:00.000Z","modified":"2026-05-16T11:22:00.000Z","valid_from":"2026-05-16T11:22:00.000Z","name":"revoke-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'revoke-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055609856049000542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98481b6d-03fd-5484-a73a-0d2568c57c99","created":"2026-05-16T11:22:00.000Z","modified":"2026-05-16T11:22:00.000Z","valid_from":"2026-05-16T11:22:00.000Z","name":"http://revoke-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://revoke-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055609856049000542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea0cce6a-be79-5bbe-ab8c-eb7d221085a8","created":"2026-05-16T11:23:00.000Z","modified":"2026-05-16T11:23:00.000Z","valid_from":"2026-05-16T11:23:00.000Z","name":"info-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055610060441600465"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b032dca-6549-5a55-83e4-8e0f2281a06c","created":"2026-05-16T11:23:00.000Z","modified":"2026-05-16T11:23:00.000Z","valid_from":"2026-05-16T11:23:00.000Z","name":"http://info-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055610060441600465"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41f9816c-3143-5d63-a649-cdfa6c806383","created":"2026-05-16T12:08:00.000Z","modified":"2026-05-16T12:08:00.000Z","valid_from":"2026-05-16T12:08:00.000Z","name":"dpdlocorn.cyou","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dpdlocorn.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055621479862002116"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5c67b35-7cfa-53a4-985b-cb93c70b7e30","created":"2026-05-16T12:08:00.000Z","modified":"2026-05-16T12:08:00.000Z","valid_from":"2026-05-16T12:08:00.000Z","name":"https://www.dpdlocorn.cyou/com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.dpdlocorn.cyou/com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055621479862002116"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccba281d-84dd-5866-aa4c-59e99d0eeb8d","created":"2026-05-16T12:08:00.000Z","modified":"2026-05-16T12:08:00.000Z","valid_from":"2026-05-16T12:08:00.000Z","name":"43.133.55.35","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.133.55.35']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055621479862002116"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2f0b416-0475-5cb1-9e19-e9a9f8501947","created":"2026-05-16T13:46:00.000Z","modified":"2026-05-16T13:46:00.000Z","valid_from":"2026-05-16T13:46:00.000Z","name":"https://github.com/acccobug/refactored-octo-invention/releases/download/v1.0.0/tax_edoc.zip","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://github.com/acccobug/refactored-octo-invention/releases/download/v1.0.0/tax_edoc.zip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055645973624336505"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--338f682e-5ed1-5be0-97a4-b521295ba26d","created":"2026-05-16T13:46:00.000Z","modified":"2026-05-16T13:46:00.000Z","valid_from":"2026-05-16T13:46:00.000Z","name":"81a2b2d2995dfa62cc137ca9374d02611e4dbcfde1fc355a231f7fac54468366","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '81a2b2d2995dfa62cc137ca9374d02611e4dbcfde1fc355a231f7fac54468366']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055645973624336505"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dde993e-5cf4-58b1-8f0c-b78f7c23729b","created":"2026-05-16T13:49:00.000Z","modified":"2026-05-16T13:49:00.000Z","valid_from":"2026-05-16T13:49:00.000Z","name":"ebec28fd7ced06e42a94319418f01fb7dc3f60a1e21821ef41d259d5ad3f2b03","description":"IOC reported by @luke92881 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ebec28fd7ced06e42a94319418f01fb7dc3f60a1e21821ef41d259d5ad3f2b03']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/luke92881/status/2055646755253895229"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e23ca45-483b-5967-9472-206585ce4f04","created":"2026-05-16T13:51:00.000Z","modified":"2026-05-16T13:51:00.000Z","valid_from":"2026-05-16T13:51:00.000Z","name":"advocat.publicvm.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'advocat.publicvm.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055647354485690522"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c355ebd8-6318-53bd-9373-ec6e1577e610","created":"2026-05-16T13:51:00.000Z","modified":"2026-05-16T13:51:00.000Z","valid_from":"2026-05-16T13:51:00.000Z","name":"http://advocat.publicvm.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://advocat.publicvm.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055647354485690522"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--727ce2e5-c166-5182-a31d-bd151f9fdfc4","created":"2026-05-16T13:51:00.000Z","modified":"2026-05-16T13:51:00.000Z","valid_from":"2026-05-16T13:51:00.000Z","name":"d7e68cc2cf439b14f9e9ef4ddbddb921b39725c8b5327e0b0b21a815751d3f85","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd7e68cc2cf439b14f9e9ef4ddbddb921b39725c8b5327e0b0b21a815751d3f85']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055647354485690522"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9358ee53-7cfa-5b18-911f-8025efbe5d98","created":"2026-05-16T13:59:00.000Z","modified":"2026-05-16T13:59:00.000Z","valid_from":"2026-05-16T13:59:00.000Z","name":"7859cf7561d4f3598700e6a30fc3527107677ae8fa9a34b72946c45834a497d1","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7859cf7561d4f3598700e6a30fc3527107677ae8fa9a34b72946c45834a497d1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055649255088324994"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c854edc-c47c-5323-a413-59d45d1f830c","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"thtamzon.com","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'thtamzon.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682873102127156"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8293335-a664-5569-86cd-457103fff621","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"https://www.thtamzon.com","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.thtamzon.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682873102127156"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc416a9b-4270-5f23-a889-41fc5cbf2c70","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"0b5f05da8131ae03d652e2a18de554700123bd861b391eec8fc7e264dc5fcc20","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0b5f05da8131ae03d652e2a18de554700123bd861b391eec8fc7e264dc5fcc20']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682875543183778"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--94610520-0502-53b5-ba11-3bcafe30fcc3","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"8d4674d062877c3a0177b4b0deff8b344794ed58d857b98f831a3abb0b797187","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8d4674d062877c3a0177b4b0deff8b344794ed58d857b98f831a3abb0b797187']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682875543183778"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--02591bc3-1e0e-53ff-99e9-f3dc5e8d46bb","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"http://47.79.253.210","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://47.79.253.210']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e127b3-01b4-5e3e-a519-713a28675fb4","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"http://43.165.179.173:5000","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.165.179.173:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0d3a51e-28a3-5f1a-a5ce-edbf147ca662","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"47.79.253.210","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.79.253.210']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--092b762a-57db-53b3-92e7-d177eef6cbfd","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"43.165.179.173","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.165.179.173']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f84483d3-5fc0-52a3-9e62-5f1f5417677f","created":"2026-05-16T16:23:00.000Z","modified":"2026-05-16T16:23:00.000Z","valid_from":"2026-05-16T16:23:00.000Z","name":"breach.st","description":"IOC reported by @bcs_erictaylor on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'breach.st']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bcs_erictaylor/status/2055685558031028679"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98a48c0c-bcf0-539c-9a96-60350d0d2cca","created":"2026-05-16T16:23:00.000Z","modified":"2026-05-16T16:23:00.000Z","valid_from":"2026-05-16T16:23:00.000Z","name":"http://breach.st","description":"IOC reported by @bcs_erictaylor on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://breach.st']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bcs_erictaylor/status/2055685558031028679"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5de1eb28-564a-5f84-a2dd-13176550e9d0","created":"2026-05-16T16:45:00.000Z","modified":"2026-05-16T16:45:00.000Z","valid_from":"2026-05-16T16:45:00.000Z","name":"3.15.0.3","description":"IOC reported by @TweetThreatNews on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '3.15.0.3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/TweetThreatNews/status/2055691017223856465"}],"labels":["Magecart"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c51b59f1-ed57-5632-ac24-26e32b28ee3f","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"noreply.gov.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'noreply.gov.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49316862-2ff2-5af9-84fc-f3d3f527a8e0","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"http://noreply.gov.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://noreply.gov.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--722bce7b-c76b-5bc1-9869-1c5cd7821201","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"http://118.194.249.36","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://118.194.249.36']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33835475-e187-5185-ad19-320eee8e1588","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"118.194.249.36","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '118.194.249.36']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b53bf791-3ec8-5aa4-9deb-f6a8361c6660","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"213.108.20.59","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '213.108.20.59']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709897862664367"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fb08eb1-c253-530a-b883-7bd297513616","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"58f41bfe0c041aebe1a42581097f7c4f7dfa0598405334b71d7bf42e6c53aa68","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '58f41bfe0c041aebe1a42581097f7c4f7dfa0598405334b71d7bf42e6c53aa68']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709897862664367"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca55f77-adbe-5bb0-968d-4ed25a9f3da4","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"8a8f1306418caaced8a278ee66044fe751d0da660e2c22517d78d2d54adb4902","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a8f1306418caaced8a278ee66044fe751d0da660e2c22517d78d2d54adb4902']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709897862664367"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0fa258d-e18b-562b-bd2c-eaf8245f21cb","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"194.147.35.34","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '194.147.35.34']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709900723081396"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f096e7d6-6b63-5f7a-a5ba-e44c87f6b039","created":"2026-05-16T18:01:00.000Z","modified":"2026-05-16T18:01:00.000Z","valid_from":"2026-05-16T18:01:00.000Z","name":"microwaved.info","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'microwaved.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2055710224321798536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f85c1545-3fc3-5389-97cb-0cd60da00a6f","created":"2026-05-16T18:01:00.000Z","modified":"2026-05-16T18:01:00.000Z","valid_from":"2026-05-16T18:01:00.000Z","name":"http://microwaved.info","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://microwaved.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2055710224321798536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6eac43ed-5c4b-561a-a7f7-be2d3a9e0ad8","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://169.40.135.249:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://169.40.135.249:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--90c9ffe9-ed73-5b80-bcf2-c8a60a8c047c","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://191.96.94.249:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://191.96.94.249:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d0cf6f4-5d65-55aa-b00c-5c958c748705","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://23.136.44.116:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://23.136.44.116:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b1048e2-3910-5376-b472-41127870818f","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://45.13.239.144:8080","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45.13.239.144:8080']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1192b11e-51f9-575c-8b56-f22cd416dec9","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://82.23.183.51:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://82.23.183.51:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8314cd2-bd0a-52aa-a6f4-62eca1a4e278","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"2pumpservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '2pumpservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--45376410-e8ca-5b90-83ff-773bf91e050e","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://2pumpservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://2pumpservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a36f95f-25d3-50f8-8761-a23ce72ebb4e","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"fatdick.pics","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fatdick.pics']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7566fae-16b4-5a57-a044-c407c97e823d","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://fatdick.pics","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fatdick.pics']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8743175a-f759-53f5-a492-2bc5dbdbe73b","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"femboyservicesapi.xyz","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'femboyservicesapi.xyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--85561535-8579-57c6-9e57-00cd6f6ca809","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://femboyservicesapi.xyz","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://femboyservicesapi.xyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6179579-6e8a-5cc2-91d5-9963dce1e6c6","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"femboyservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'femboyservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aac2f04c-37d6-5c2e-9a85-ebe5668b7498","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://femboyservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://femboyservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--11da56cb-853b-53f9-a446-30ac8fc7ca59","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"191.96.94.249","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '191.96.94.249']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3953a2aa-953b-5b5c-80a4-f6d0ffe091b5","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"23.136.44.116","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '23.136.44.116']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eaf666e-4f30-5273-8edb-ddb74e360aa0","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"45.11.229.22","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.11.229.22']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--341d7f78-c0ad-5e19-9315-629d43b7741e","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"82.23.183.51","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '82.23.183.51']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c331f3e-ca69-516a-a8dd-747dca80506b","created":"2026-05-16T20:13:00.000Z","modified":"2026-05-16T20:13:00.000Z","valid_from":"2026-05-16T20:13:00.000Z","name":"agenziaentrate.grillwestfrentes.com.ar","description":"IOC reported by @Slvlombardo on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'agenziaentrate.grillwestfrentes.com.ar']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Slvlombardo/status/2055743469549756779"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b39102e3-94f3-5522-bdc0-9204b0b9fbda","created":"2026-05-16T20:13:00.000Z","modified":"2026-05-16T20:13:00.000Z","valid_from":"2026-05-16T20:13:00.000Z","name":"https://agenziaentrate.grillwestfrentes.com.ar/rimborso/it/","description":"IOC reported by @Slvlombardo on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://agenziaentrate.grillwestfrentes.com.ar/rimborso/it/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Slvlombardo/status/2055743469549756779"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05d8db4c-ee50-5193-a91f-c03ccc4734a0","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"share2e32git.sbs","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'share2e32git.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5556d58-d417-50c6-af30-b0662cf2d77a","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"http://share2e32git.sbs","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://share2e32git.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--932de585-1e81-5238-9400-65cf835d0d8a","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"plombirsirni.com","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'plombirsirni.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be016282-269f-5398-8235-ca932136a071","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"http://plombirsirni.com","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://plombirsirni.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]}]}