{"type": "bundle", "spec_version": "2.0", "id": "bundle--d5e9b507-4bde-4af4-a31c-a3a8a8ff950d", "objects": [{"type": "identity", "id": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:45:14.000Z", "modified": "2026-05-04T11:45:14.000Z", "name": "Talos", "identity_class": "organization"}, {"type": "report", "id": "report--917dc069-9f94-4b5c-98dd-14b4638eda50", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:45:14.000Z", "modified": "2026-05-04T11:45:14.000Z", "name": "CloudZ RAT potentially steals OTPs messages using Pheno plugin", "published": "2026-05-05T10:03:04Z", "object_refs": ["observed-data--639c58f2-687a-4c26-affc-0053413703b8", "x-misp-attribute--3df9e634-2fa0-446f-ae84-cb6774c3330f", "indicator--b6d0aedc-c47d-4764-8a21-a7571d425750", "indicator--ccf57185-2485-4448-8105-ee957aeb0ee3", "indicator--528c247d-fec7-40a0-90d6-0523fa6c92bd", "indicator--6daed766-e4f6-40b3-8b1c-79c1f8d0e46e", "indicator--07203e73-922f-44cf-a340-27697418ad27", "indicator--57bb66ef-b4e2-48a2-beac-a9486bb672a4", "indicator--543402d1-32f6-44b5-800a-864602fd8cc4", "indicator--b03c538c-9e78-4a1a-bb2a-c06656563e1f", "indicator--5940ce74-75de-4604-9bb5-f6ec86e68b8a", "indicator--0a576540-81c5-4360-b33b-70d941c040c4", "indicator--aed5726f-f1d1-4007-8458-9f75060921fd", "indicator--3b3c6905-0d9d-4e80-96f3-fc0b2c0bdf77", "indicator--9bd6cec6-561a-4d05-b012-79858cbc964a", "indicator--e968f1d0-b34f-4221-bda2-6c6e1108bfc0", "indicator--8d2b1f39-4b7f-4a46-a7c5-f7d85bc2298b", "indicator--b016714e-34eb-4ca8-96be-758a66f3a576", "indicator--0fe9eea7-90fa-4464-9116-ffb90c96f978", "indicator--473ca0bb-da35-4370-b071-ce4f470118d3", "indicator--ee8dc3f7-0dc7-4c04-b605-56c5cc3e4d91"], "labels": ["Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", " TLP:WHITE", " rat", "Talos_Intel_Blog", "infostealer"]}, {"type": "observed-data", "id": "observed-data--639c58f2-687a-4c26-affc-0053413703b8", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:32:49.000Z", "modified": "2026-05-04T11:32:49.000Z", "first_observed": "2026-05-04T11:32:49Z", "last_observed": "2026-05-04T11:32:49Z", "number_observed": 1, "objects": {"0": {"type": "url", "value": "https://blog.talosintelligence.com/cloudz-pheno-infostealer/"}}, "labels": ["misp:type=\"url\"", "misp:category=\"External analysis\""]}, {"type": "x-misp-attribute", "id": "x-misp-attribute--3df9e634-2fa0-446f-ae84-cb6774c3330f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:33:49.000Z", "modified": "2026-05-04T11:33:49.000Z", "labels": ["misp:type=\"text\"", "misp:category=\"Payload type\""], "x_misp_category": "Payload type", "x_misp_type": "text", "x_misp_value": "CloudZ RAT"}, {"type": "indicator", "id": "indicator--b6d0aedc-c47d-4764-8a21-a7571d425750", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:43.000Z", "modified": "2026-05-04T11:42:43.000Z", "description": "CloudZ dropper .NET executable", "pattern": "[file:hashes.SHA256 = '65fcd965040fabeb6f092df0a4b6856125018bb3b6a1876342da458139f77dac']", "valid_from": "2026-05-04T11:42:43Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ccf57185-2485-4448-8105-ee957aeb0ee3", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:43.000Z", "modified": "2026-05-04T11:42:43.000Z", "description": "CloudZ Loader .NET executable", "pattern": "[file:hashes.SHA256 = 'ed5de036edbbda52ab0049d2163607038d38a49404a46b6bcfc4bac26b743832']", "valid_from": "2026-05-04T11:42:43Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--528c247d-fec7-40a0-90d6-0523fa6c92bd", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:43.000Z", "modified": "2026-05-04T11:42:43.000Z", "description": "CloudZ Loader .NET executable", "pattern": "[file:hashes.SHA256 = '24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54']", "valid_from": "2026-05-04T11:42:43Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--6daed766-e4f6-40b3-8b1c-79c1f8d0e46e", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:43.000Z", "modified": "2026-05-04T11:42:43.000Z", "description": "CloudZ RAT", "pattern": "[file:hashes.SHA256 = '5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321']", "valid_from": "2026-05-04T11:42:43Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--07203e73-922f-44cf-a340-27697418ad27", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:43.000Z", "modified": "2026-05-04T11:42:43.000Z", "description": "Pheno Plugin", "pattern": "[file:hashes.SHA256 = '33af554562176eff34598a839051b8e91692b0305edfdbb4d8eb9df0103ffd98']", "valid_from": "2026-05-04T11:42:43Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--57bb66ef-b4e2-48a2-beac-a9486bb672a4", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://calm-wildflower-1349.hellohiall.workers.dev']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--543402d1-32f6-44b5-800a-864602fd8cc4", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://orange-cell-1353.hellohiall.workers.dev/pheno.exe']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b03c538c-9e78-4a1a-bb2a-c06656563e1f", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://round-cherry-4418.hellohiall.workers.dev/?t=1769729309']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--5940ce74-75de-4604-9bb5-f6ec86e68b8a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://pastebin.com/raw/8pYAgF0Z?t=1771833517']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--0a576540-81c5-4360-b33b-70d941c040c4", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://pastebin.com/EBrpRiFi']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--aed5726f-f1d1-4007-8458-9f75060921fd", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://pastebin.com/ikjGHALD']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--3b3c6905-0d9d-4e80-96f3-fc0b2c0bdf77", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://pastebin.com/3jKbe7rN']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--9bd6cec6-561a-4d05-b012-79858cbc964a", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://pastebin.com/NUrZTmDn']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--e968f1d0-b34f-4221-bda2-6c6e1108bfc0", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://pastebin.com/RKJcXMAm']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--8d2b1f39-4b7f-4a46-a7c5-f7d85bc2298b", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "Hosting URL", "pattern": "[url:value = 'https://pastebin.com/yUkbaBH3']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--b016714e-34eb-4ca8-96be-758a66f3a576", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "hosting domain", "pattern": "[domain-name:value = 'calm-wildflower-1349.hellohiall.workers.dev']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--0fe9eea7-90fa-4464-9116-ffb90c96f978", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "hosting domain", "pattern": "[domain-name:value = 'orange-cell-1353.hellohiall.workers.dev']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--473ca0bb-da35-4370-b071-ce4f470118d3", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "hosting domain", "pattern": "[domain-name:value = 'round-cherry-4418.hellohiall.workers.dev']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--ee8dc3f7-0dc7-4c04-b605-56c5cc3e4d91", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2026-05-04T11:42:44.000Z", "modified": "2026-05-04T11:42:44.000Z", "description": "CloudZ C2", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.196.10.136']", "valid_from": "2026-05-04T11:42:44Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Network activity"}], "labels": ["misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\""]}]}