{ "type": "bundle", "id": "bundle--4fc8bd9d-df64-5596-aa7b-4a59c8d7eace", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--294ec63a-c449-5439-83fb-942185697747", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "name": "adint-scan IOC set", "identity_class": "system", "description": "Curated from public reporting. NOT affiliated with, and NOT endorsed by, The Citizen Lab or Confiant." }, { "type": "malware", "spec_version": "2.1", "id": "malware--75526ba0-abba-56bc-af06-770a39688ab3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "name": "Candiru", "is_family": true, "description": "Mercenary spyware from the Israeli vendor Candiru (US-blacklisted since 2021), delivered zero-click through Discover-Tech's Controlium ad platform in the AdFection campaign.", "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74b8e458-3dfb-5c8a-b187-8b25a1a6a071", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "104.207.153.0", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '104.207.153.0']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a706cd83-7ef4-5734-be39-6621f183c5cf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "107.170.37.216", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '107.170.37.216']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dd16f702-8fdb-503f-acfd-2a6a68ee2da5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "107.170.42.32", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '107.170.42.32']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b899b27-9513-5138-a76f-e179b1bfc84c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "107.170.42.56", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '107.170.42.56']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ca6c0518-f307-598f-9a8b-07ecf951b8dd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "134.209.220.157", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '134.209.220.157']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d3302b7a-4792-5188-9240-5bb890f0c74b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "134.209.3.89", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '134.209.3.89']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--30164156-f885-5f34-a487-acc0176efc97", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "136.244.69.219", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '136.244.69.219']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2ea7e1c4-5a0f-5754-ab41-2e4ee3089bf3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "137.184.254.107", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '137.184.254.107']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b7719b9b-d659-5882-9921-da07d189133d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "138.197.43.97", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '138.197.43.97']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c43c260a-4ce9-5a85-8ac4-974d0b307e99", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "139.59.14.26", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '139.59.14.26']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3b23217a-27a5-5513-a568-6aa594c54f25", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "139.84.208.188", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '139.84.208.188']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--734bdb5c-d3da-5d9a-ada1-369bc67c098a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "140.82.5.20", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '140.82.5.20']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--97eaba41-e7e4-5d9e-afe9-7e3ac4a0490f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "143.198.64.22", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '143.198.64.22']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--20b7f35a-703b-5713-8a68-29a8374329db", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.102.108", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.102.108']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--364a1d3b-aed3-5f06-bdf2-c0c8d6b15b18", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.102.110", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.102.110']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6fb0e044-4dc9-5f5b-a984-9e6f705fc8af", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.102.121", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.102.121']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--53f9fcbc-6c6d-5568-b678-83cefc77dd8c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.102.134", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.102.134']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7852f146-c6be-5413-9000-389aee47e361", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.116.7", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.116.7']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6dfd456b-7c30-55c4-a932-ce32c7cf8f31", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.131.224", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.131.224']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1d98520d-938c-5a0d-ad59-2df9a1ec88e9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.147.9", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.147.9']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d1d1bdd6-6924-5363-9eba-b2a7d4f69a05", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.160.49", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.160.49']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--122e9a9f-b108-5d02-9603-78952d79d37b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.169.165", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.169.165']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--86d118d5-d8aa-5981-9a1c-a400159d5b87", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.20.203", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.20.203']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--283c360f-94d6-551c-8129-eb013acdea9d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.29.228", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.29.228']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2c4f0866-02ed-599e-bec2-76dd17f42edf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.53.156", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.53.156']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--45ad95ba-c815-51e6-ad4c-83244e545325", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.81.218", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.81.218']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7e7a7983-e430-53c0-83c7-90eea3dca0c6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "146.70.86.251", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '146.70.86.251']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f3285b0a-a5c9-55b4-be7b-ce4dd027f074", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "147.182.161.167", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '147.182.161.167']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--20c5adde-23eb-549d-b83f-758766367b22", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.248.1.147", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.248.1.147']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--38c57dff-53f1-595a-b8b5-5b8b2a6df1ec", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.28.142.211", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.142.211']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--921102f2-a3b8-550c-89a7-5cde42d07f43", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.28.242.133", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.242.133']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--473da9ec-128c-5c82-96ab-f9b8aac1db2c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.28.250.35", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.250.35']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a6908b38-c346-5f2c-b55f-ffd529bca9d7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.28.253.112", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.253.112']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3cd1461e-c129-5199-9330-100c8b54ea8a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.28.57.173", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.57.173']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c7b88823-7b76-59b3-918e-03794291ce49", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.28.71.25", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.71.25']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9c5a8f5c-13bf-5448-b93e-3c2a43d8017d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "149.28.77.207", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '149.28.77.207']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--586e080a-5f89-5ba4-99cc-86a5e57ddd3a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "152.42.226.197", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '152.42.226.197']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0fcb8093-a1ff-5b59-a391-65a70ec0301b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "155.138.163.117", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '155.138.163.117']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--815e80a1-8d66-5c93-9f37-c557e33bedf5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "155.138.202.66", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '155.138.202.66']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f9282a37-6dcb-5193-a698-ddf4f549ae22", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "155.138.240.74", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '155.138.240.74']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4cf0d954-cbc5-5d0a-9b1f-7c611a6ddb76", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "157.230.128.10", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '157.230.128.10']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a201cac6-569b-54aa-bd7b-bf4b4f29fa40", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "157.245.176.133", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '157.245.176.133']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9994332b-67df-5f81-8781-1441c49747e7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "158.247.194.199", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '158.247.194.199']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ef161103-fdab-5eb4-bfc9-7c58f6e48671", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "159.223.151.126", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '159.223.151.126']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--424cca24-e23e-5e32-9dda-86f5febc5a30", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "159.223.208.191", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '159.223.208.191']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ec331b79-9cc5-51dc-99a2-49e9270ab63b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "159.89.14.225", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '159.89.14.225']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c4f8708b-a083-5997-9f4f-2aa5c2a3c65d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "161.35.150.79", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '161.35.150.79']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--325e86f7-45fa-5006-b59a-3be44d7fe2b1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "164.92.225.66", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '164.92.225.66']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1ce4d207-1206-54df-a574-62e0c9205ed5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "164.92.235.125", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '164.92.235.125']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ba6fa81c-d5b8-56e9-bca9-40db86aa2444", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "165.22.5.231", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '165.22.5.231']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--09d0df16-c5fa-57c6-8bd8-cf0978005b42", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "165.22.51.81", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '165.22.51.81']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--98b7cc3c-cc5b-5a64-8ba2-38804bb04068", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "165.22.71.71", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '165.22.71.71']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aed0e4da-c6b9-5fe7-b4bd-467d8796f445", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "165.227.145.109", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '165.227.145.109']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fe9895cf-a21c-5848-9ebe-c9cba4aa5b70", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "167.99.3.150", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '167.99.3.150']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e81acee1-9a50-50a2-91cd-f30604cadb1c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "167.99.85.48", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '167.99.85.48']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--07b68cfb-69d6-552a-8cc4-5ba6a631c355", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "174.138.34.46", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '174.138.34.46']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dbb8446a-534b-5370-9283-81f4120ec437", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "178.128.49.106", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '178.128.49.106']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3fed1d42-6019-5542-8d59-02d65a2bcd0f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "185.181.8.155", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '185.181.8.155']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--65fb5a3a-0c07-5553-92b5-6f2fad82a632", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "185.234.52.230", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '185.234.52.230']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f82a6982-3f3d-5454-8cd8-1a7632aeb3fa", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "188.208.141.190", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '188.208.141.190']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1466e0d2-ebf1-5815-9340-843cc89b646e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "194.180.158.45", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.180.158.45']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cce1e199-4417-586f-bdee-6ec1671756b8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "194.180.158.71", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.180.158.71']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--80cc0359-6559-513a-881d-fd03be26e8f6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "194.180.191.84", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.180.191.84']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--81532265-3870-5a50-8a97-a8ba748c6b87", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "194.37.97.159", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.37.97.159']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f6c2b960-2490-545c-aa52-2bffc21aa959", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "198.211.98.248", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '198.211.98.248']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f57ae10-c153-56c9-97a5-dd976173afb1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "199.247.10.38", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '199.247.10.38']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5aa9ef46-9a37-5de2-ac7a-223d73563c66", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "206.81.14.237", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '206.81.14.237']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--759709a2-a08c-5647-90ca-482b48f69cd4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "207.246.105.206", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '207.246.105.206']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0889601a-7d30-5767-996a-34c094d46af9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "207.246.113.7", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '207.246.113.7']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c1d9cd96-fd92-5254-b65a-4cfe3cf0b6d8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "207.246.87.188", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '207.246.87.188']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a3db8ab0-ecb3-579f-b7b6-0181e8021452", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "207.246.90.6", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '207.246.90.6']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7d43cabe-b445-51c7-93dd-3c1d50e6129f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "208.76.221.167", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '208.76.221.167']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--783ca176-1828-5f2f-817c-4737dd215278", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "208.76.223.59", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '208.76.223.59']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--96b1b765-a198-570f-b877-518f7377f6ca", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "208.85.18.104", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '208.85.18.104']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dffc34f8-a52b-5797-81a2-914546b97922", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "213.252.232.129", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '213.252.232.129']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ecf9c6d1-ac93-550b-85b6-7c2b51614c3c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "213.252.232.141", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '213.252.232.141']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ed5c4b82-e9fb-50c4-874f-67514ccc8325", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "216.128.178.12", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '216.128.178.12']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6e095799-48c1-56c4-95f1-7d95ea83cc7a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "216.238.77.17", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '216.238.77.17']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--db6d3de8-743e-53f2-b197-1df444fc4ae1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "216.238.80.164", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '216.238.80.164']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b4442a4-d367-57f8-9e15-7fccda83b387", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "216.238.86.164", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '216.238.86.164']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9707fff2-91c5-59f3-b8e0-e7e58ff22d02", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "216.238.91.249", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '216.238.91.249']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c75c1014-a327-59cb-b568-dfbb03726b49", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "217.69.10.11", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '217.69.10.11']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--264d904c-1f74-53e4-ab9b-d3bdf123100c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "217.69.6.58", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '217.69.6.58']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--697e041d-4145-587a-96ce-86e1a6f91513", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "23.227.198.196", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.227.198.196']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--602eb27f-640d-5013-b84c-0772eff99f2f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "23.29.115.188", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.29.115.188']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9a219b0f-fde9-5955-9e52-5104cb0197c8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8", "description": "SHA-256 of a published Candiru sample. One build only; another victim's binary will not match.", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:sample", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f804b9f-ff42-55e2-a50b-b8d0e72eeb48", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "38.132.101.35", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '38.132.101.35']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--14c458ed-e035-516f-a05a-7b06e880e8c8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "45.32.109.170", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.32.109.170']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c56873ec-da79-5723-98ed-935cb7645f2c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "45.32.150.100", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.32.150.100']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c1ee157c-8879-51f1-93bb-a38d242b408f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "45.76.252.109", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.76.252.109']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d716862f-e0c8-5641-891a-81664a5444d2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "45.76.31.6", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.76.31.6']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a3cf78d1-aedb-5cde-b5de-85912418bd7a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "45.77.105.76", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.77.105.76']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e9e09667-bd4e-5935-a9ed-d695ef2e71bd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "45.77.57.173", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.77.57.173']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3eb861c4-18f6-5e10-9876-8819e6e912bc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "5.181.159.109", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '5.181.159.109']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--953e8da2-f917-5e5c-a90b-424d46466b2b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "5.252.178.158", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '5.252.178.158']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--06699a72-b150-5f62-bb06-50b955506307", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "52.174.65.77", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '52.174.65.77']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--13077d18-3007-58e9-a16e-be3b10516172", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "64.225.3.138", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '64.225.3.138']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--125aa7f4-26ee-5378-9dbc-d791f2fa7654", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "64.226.103.163", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '64.226.103.163']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c3f1bc8-f3d6-5933-9436-d491a753661a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "65.20.105.177", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '65.20.105.177']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d8af6b1-c088-54af-9119-c1e10647bc23", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "65.20.106.49", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '65.20.106.49']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9c6d3357-0678-5402-b490-93770cb17f30", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "65.20.96.9", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '65.20.96.9']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5197cb55-ed9d-5b83-a075-0f4f3ac745ae", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "66.42.126.125", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '66.42.126.125']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b9e04445-ff86-5bfa-90c6-3e3216575c7e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "66.42.73.169", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '66.42.73.169']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--50d049fc-28bc-5fa5-aac9-e1afc2dfa66e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "68.183.169.21", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '68.183.169.21']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fea94816-4fb1-58cb-a215-26685b235778", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "68.183.186.185", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '68.183.186.185']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cd8853a9-bd58-57da-9daf-c0d045ad1d09", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "70.34.194.5", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '70.34.194.5']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--626ee39c-1876-527c-8033-f583cb96b4ac", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "70.34.251.208", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '70.34.251.208']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2c4fd1ed-a040-5344-982b-b3a5b00886a3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "84.247.51.183", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '84.247.51.183']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--145219c7-0b5d-53d6-9665-2cf1db49142b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "88.119.175.56", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '88.119.175.56']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b24726c5-9b1c-59bc-8757-b6ce99bd108d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "88.119.175.75", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '88.119.175.75']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--639b840c-8918-56db-8d09-9f202e76b370", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "91.207.173.115", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.207.173.115']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2397465c-debc-5c7b-9175-868c9dac4f3b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "95.179.215.54", "description": "IP address of Candiru-attributed infrastructure. WEAKER THAN A DOMAIN: these are mostly cloud-hosted addresses from a 2025 report and are very likely reassigned to unrelated tenants by now. Only meaningful if the hit is dated within the reporting period.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '95.179.215.54']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru-ip", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--60f5ef60-16d8-5da6-a772-0334c54f2d82", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "addthis.events", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'addthis.events']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--988c09e2-5a2d-5105-ab35-880089ba8f29", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "ads-impressions.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ads-impressions.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3baf930c-b6b9-5853-9f24-621cfde2876e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "ads-monitor.xyz", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ads-monitor.xyz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--10656dc4-6490-5f0a-a046-8010cd9bed7f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "adtimizer.co", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'adtimizer.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8566c6fe-a3d5-589e-b1c6-29a505838528", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "adtrack.link", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'adtrack.link']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-catalangate-2022" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru (2022-04-18)", "url": "https://citizenlab.ca/research/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8a8b8c23-dc1e-55bd-82f6-bb627413ecb5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "adtracker.link", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'adtracker.link']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9b40e4ce-b130-5635-b5f6-12bef024eb36", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "akedo.gg", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'akedo.gg']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d50ab501-67af-5d20-9ae3-050d563384f3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "amazon-cz.eu", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'amazon-cz.eu']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d8cff811-3de7-5597-a9e2-f49e95c9b85f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "ambiguouscommerce.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ambiguouscommerce.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3623bcdf-ba0d-5d9e-bd03-67788f3cb4f9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "amnestyreports.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'amnestyreports.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2e58598e-265b-502c-a90b-145786a295f0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "antperspective.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'antperspective.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fe87a3e0-b0ee-54ad-aeac-70b163937d85", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "aperturebelt.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'aperturebelt.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--40e07b83-402e-528e-a762-ab31e133a1f0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "apple-updates.online", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'apple-updates.online']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3fe22e7e-08ae-56c7-885a-52d55c4bd831", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "aqaf.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'aqaf.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:amnesty-candiru-indonesia-2024" ], "confidence": 50, "external_references": [ { "source_name": "Amnesty International Security Lab", "description": "A Web of Surveillance: Unravelling a murky network of spyware exports to Indonesia (2024-05-01)", "url": "https://securitylab.amnesty.org/latest/2024/05/a-web-of-surveillance/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d2e3758-67f8-5a3e-92ff-c7b98f9ea915", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "archer.westeurope.cloudapp.azure.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'archer.westeurope.cloudapp.azure.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--314e342e-b5cc-5689-aa7f-608b4f30c14e", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "armenpress.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'armenpress.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6d07a0d7-9c72-5b3f-af90-cfa24c46d06d", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "armenpress.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'armenpress.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5624e7be-eb19-5136-b380-714b3fa7e95b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "armlur.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'armlur.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4e84a08c-af8c-5648-8b34-517f11afe6ff", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "armradio.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'armradio.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f15cb929-b882-5b61-bad8-46e1f9962b5a", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "armtimes.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'armtimes.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0c959e32-1cc1-57c5-9927-d34af036c4b6", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "armtimes.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'armtimes.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--068d1d20-bfd8-5b42-a5a9-e27f8b5d2f12", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "asbares.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'asbares.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e29fcbe7-02f5-52e3-83a5-3d442321ca29", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "asknapkin.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'asknapkin.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74b654e3-93f1-513b-a534-6792ad4e45b3", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "backxercise.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'backxercise.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e55b7fec-0865-59c1-8323-184e4a34c483", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bad-shop.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bad-shop.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0a106c3d-8e79-5aca-9301-5a5f0b792d28", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "barnsecret.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'barnsecret.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a7c2727-f428-5e2f-9546-d9c536b6baa6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "baseagriculture.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'baseagriculture.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fce6dd87-a10a-5a75-83ac-e394d253da57", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "basicstraw.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'basicstraw.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b485ff61-b6ab-5358-874e-5655b65ab8b3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "basinapposite.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'basinapposite.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cb97286e-b226-55f3-a09c-acb2a966894f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bd-mainserver.herokuapp.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bd-mainserver.herokuapp.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8170af07-ac15-57df-b008-b00e771fb2a8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "beneathbreadth.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'beneathbreadth.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e88815ea-a7bc-5e1d-820c-d43b353a0d15", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bestcarent.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bestcarent.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--73642a0f-2eb4-54fe-9ae5-8dfa564915dd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bit-ly.site", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bit-ly.site']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a7732974-8a28-5a51-a06b-01e5219ddd6b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bitly.bz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bitly.bz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c0f5ea3-4898-58f2-a449-7c9ca6a4651a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bitly.tel", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bitly.tel']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d5f20cb3-19d5-5c58-a564-293d6efb7554", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bitly.tw", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bitly.tw']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d53006b-6c0f-55eb-9c6c-b97e2c96bae5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bitly.zone", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bitly.zone']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1e1a1439-9f49-5563-97b2-63b6a8b49471", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bizarreclassify.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bizarreclassify.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0af03a24-5e0d-5ca5-a2f6-d8b3be69d2ce", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "blacklivesmatters.info", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'blacklivesmatters.info']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--70eac4aa-63ce-5fc6-aa67-4f0f652f2a78", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "blockroster.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'blockroster.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--381e46dd-ac74-58d3-b54c-8f29646b4bb1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bondmuscle.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bondmuscle.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ad43b3e1-dd4e-5190-b3cc-112d454fe378", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bootstrapcdn.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bootstrapcdn.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e8ee60e2-5360-5b99-bcea-d19151cee3bf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "breadgroomer.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'breadgroomer.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5555e634-cee2-543d-a344-c47742599cae", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bronzemonth.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bronzemonth.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--633225aa-8583-5936-affa-a9f950093a36", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "browniebell.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'browniebell.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f0335175-b0d7-5e3a-a2fb-f97198b2dc84", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bypassbirch.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bypassbirch.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--38d6936b-d6fb-5e8a-911c-3ac0f91e390f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bypasscalculate.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bypasscalculate.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e4921ae-b2b7-53fd-996b-3c35fed63a56", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "bypasscommerce.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bypasscommerce.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9cb2fdec-c6fd-59c1-b64b-8f2270d64993", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "calmbase.org", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'calmbase.org']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--37e8331d-3c70-51ef-8592-035e64cb3a7f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cartoondrop.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cartoondrop.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7e54fd2d-f308-56b5-9669-8d9d32f92501", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cdnmobile.io", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cdnmobile.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fbd612d4-973c-51a7-adaa-b8558f9657f1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "checkmyimp.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'checkmyimp.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--28e7318f-6d70-582d-87b0-113d9d053f11", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "chickenstrawberry.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'chickenstrawberry.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d13bb7df-fb3c-58b8-b4fd-543c34b592a0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "citecivilization.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'citecivilization.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d2bfd22d-5ad6-53a7-9c22-e5a2dfd18a02", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "clickcease.app", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'clickcease.app']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d8528e57-9b6c-5ff1-b94e-d3e2eca689ac", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "closetmeat.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'closetmeat.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--93f01785-17ec-5e7e-89a2-c17c26b21c5a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cnn24-7.online", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cnn24-7.online']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b366063a-92c3-5614-af57-d1e40aac4858", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "code-afsanalytics.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'code-afsanalytics.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4d6a1972-356e-5e13-8e95-6049d7f414dd", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "codeingasmylife.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'codeingasmylife.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f62a1619-9e26-5d40-95ca-527496299442", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "colorpallatess.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'colorpallatess.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--08e4577c-5a2a-5281-a434-c154096999a3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "commonclever.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'commonclever.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--847caad1-0809-5654-802e-41664a29c4a4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "concretebottle.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'concretebottle.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--15739160-0a0d-5020-9bd8-8b49da084209", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "conquerconfess.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'conquerconfess.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c2b93e7-4baf-5004-8856-a792e323d77c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "containsnow.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'containsnow.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4030e321-22d7-53dd-8af8-7bd992841ec3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "contradictionblindness.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'contradictionblindness.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1827ff3e-4d6e-5ed0-a0fa-e6a22c5378ae", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "controlium.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'controlium.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--18fda003-8e46-5b6f-89d1-cedeef785557", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "convincechaotic.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'convincechaotic.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3f34990e-d09e-58e0-b4dc-8435959bbe95", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cookie-sync.xyz", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cookie-sync.xyz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c106f88c-abb0-54c6-913b-cd4797389d6c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cookiesurfer.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cookiesurfer.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--443ccd83-0af1-5cb0-ab85-cd0b3b88a98d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cooperatedisinfect.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cooperatedisinfect.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b975b874-8675-53e1-9511-bcdcdd444b5f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "core-update.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'core-update.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--135cf875-540c-525d-8184-f758e843799b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cortana.cloud", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cortana.cloud']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-catalangate-2022" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru (2022-04-18)", "url": "https://citizenlab.ca/research/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4b9c1e99-f84c-5fd1-8472-08bf2822ccb2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cortanaupdates.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cortanaupdates.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3e404a8d-e5ca-596d-a45d-b8c2a0ae2488", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cottonbread.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cottonbread.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f076b92d-5c84-5784-9127-420cc363574a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cranberrybear.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cranberrybear.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e4186723-9847-523d-9017-be5ebf434254", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cropcritique.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cropcritique.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5737d9d5-8674-506d-9498-cd6ac483c159", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "crossoverdue.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'crossoverdue.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e6381373-2238-577e-a0b9-cda9d8145079", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cuturl.app", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cuturl.app']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6474b80e-1369-5e76-b620-f79fcca7d331", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cuturl.space", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cuturl.space']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0663b862-e3ba-5c38-874e-66aa458deb82", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "cyprusnet.tk", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'cyprusnet.tk']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1c84ceb0-fe42-5903-9c24-7cb5b35be72b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d147nolwbekx2b.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd147nolwbekx2b.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ad146f3d-7905-5942-bea8-f3b7e9414f4e", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d19oo8r6k9oumb.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd19oo8r6k9oumb.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7618b9f7-b2a1-5a57-93cd-e3f675dc4a07", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d1fcoizt7mje85.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd1fcoizt7mje85.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f454ef43-cd94-5f72-829b-2ceeb8016946", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d1fzw0miu1r9rc.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd1fzw0miu1r9rc.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--62fd37ec-7e77-56a6-beab-af60413482d4", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d1x4e580sn23dn.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd1x4e580sn23dn.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4b509ac8-bcf8-5f97-ab3a-dbcb6ad72810", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d23625plpxg1yn.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd23625plpxg1yn.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--04c3f043-bb15-5ec8-9e7c-4cacd222a47c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d2epnp0vokbtl7.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd2epnp0vokbtl7.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6f1ca82a-f398-5508-9db6-954f0f700497", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d2f4zpg1mgzwov.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd2f4zpg1mgzwov.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9aa7190d-c6d8-530a-8c7a-c8b6d97fda5b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d39619tdxn6mhj.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd39619tdxn6mhj.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f7261ad3-b382-5b7b-b88f-a9d072322207", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "d8lmy5wyiokrq.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'd8lmy5wyiokrq.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eb5e393c-9543-5a38-95d0-e9a560758718", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "damageconsider.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'damageconsider.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--92ec8eca-24c4-5f5e-989f-52645092bafa", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "datanalytic.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'datanalytic.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--55fb7f39-0850-5489-a387-217047bdaecd", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "db-control-uplink.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'db-control-uplink.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--12ff0d70-a4ff-5cca-8e80-8bafb253aec7", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "dcv2rnj2ograe.cloudfront.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'dcv2rnj2ograe.cloudfront.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--96505ef7-15df-5d7a-b0a8-3a8f2592887e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "deardrill.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'deardrill.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--840f58bb-5924-5061-80d5-ea81e1a4bb92", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "dediccatedconsideration.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'dediccatedconsideration.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a8ea7be1-8d57-5cce-a401-83049a0ee507", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "deducedefend.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'deducedefend.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--46998941-e9ee-5102-94f2-dca93a4557a9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "deliverconcern.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'deliverconcern.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9179f07b-247c-58fd-84b5-586d8dc96ef2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "densefoot.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'densefoot.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0f81b6c1-12f5-554d-b4e9-415d724b38f4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "desireeclipse.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'desireeclipse.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9c921045-4123-532b-8b79-6dc129637d30", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "detaincharity.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'detaincharity.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f094e140-6365-52fe-a428-e2d3fedc18a2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "deterdiffusion.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'deterdiffusion.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9f78fe24-e591-5d8c-8f78-2cd5414da78f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "devotionbelief.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'devotionbelief.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f0605778-593c-5c24-a0e4-4e54c0960bc1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "discover-tech.io", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'discover-tech.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--490dce38-65ac-5f40-8929-7f3695646f50", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "discovertech-alb-100966113.us-east-1.elb.amazonaws.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'discovertech-alb-100966113.us-east-1.elb.amazonaws.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a2e021de-573d-573c-af8d-2eea4fc3e75e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "distractionfar.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'distractionfar.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a01c8de3-ac3e-5000-bae6-cbf1e2078a34", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "doubleclick.ac", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'doubleclick.ac']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4746b71-62f4-5283-a3e8-3e0a3025bdd5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "drivesplash.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'drivesplash.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--52f97fd2-c7f3-5974-8cbd-ab8cfff8e8ab", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "drpbx-update.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'drpbx-update.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--21c6a678-5ea8-5139-85eb-7c80818e611c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "drummerjourney.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'drummerjourney.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--16cf74e7-7256-5dfb-a5aa-d66ee1f8db2c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "dtech.adtimizer.co", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'dtech.adtimizer.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--277fbd1e-0e02-5425-8faf-c2e9e3ed693c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "dtech.mtrtb.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'dtech.mtrtb.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c2fa2cb-2a91-5008-bf67-fee6882df253", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "dumplingbell.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'dumplingbell.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa65a587-6674-5a6e-a8bf-952aab715a13", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "dw-arabic.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'dw-arabic.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7dcb6ff3-df78-5612-87b9-1a02a9583038", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "electric-prime.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'electric-prime.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--93f2ef5d-adc1-5652-8394-2231b7fce79f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "elifluousscintillam.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'elifluousscintillam.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3d0e8ea7-31e0-5cda-ab35-9fdc668a7e12", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "eminententwine.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'eminententwine.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aad95097-8a51-58ce-bfc7-561e2545a974", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "engagebaay.app", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'engagebaay.app']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--52dd2ef8-6664-5864-9976-9271cec9ab16", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "engagebay.app", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'engagebay.app']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--07ac9fd8-c25b-58f1-9d8d-b63178640ba7", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "eulenformacion.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'eulenformacion.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a58bf6ed-151b-52aa-bb3e-c847e356f28e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "euro-news.online", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'euro-news.online']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--29f43c4d-5fc4-578c-a76f-0bd56c741d30", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "events.myweb3id.io", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'events.myweb3id.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--75138b27-51a0-5721-8d4d-7d8118ed2589", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "events.platc-tester.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'events.platc-tester.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b352b5f2-a30f-5585-b0f8-fa337d693a7f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "exhibitexpanse.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'exhibitexpanse.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b802e3a4-ed92-5296-b26c-9c0d5ebc7869", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "expertglobal.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'expertglobal.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0f189626-a465-5e17-85a8-893499d35f6d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "faceb00k-live.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'faceb00k-live.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--21875a74-3953-5933-a25d-a62c189a7b92", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "fallaciousessential.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'fallaciousessential.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a457cc88-b972-5926-bac8-d6e3d1db4ea8", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "fbcdnads.live", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'fbcdnads.live']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d5ca03fb-d0bc-5ff4-afd2-dcbfade16ff3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "fearevolve.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'fearevolve.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3d9bf952-f41c-5d19-bb2d-9be6828d2f85", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "fileswaper.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'fileswaper.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4e07f13e-8941-5a4b-99c3-5782f061e120", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "finalsalami.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'finalsalami.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8430ca8a-f29b-535b-863e-bd0d15a9ad5e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "flexibleelevator.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'flexibleelevator.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--949a46bd-6b4c-5741-ac48-99060d96bbf0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "foamdirection.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'foamdirection.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--93225fa3-0f11-5a45-b880-e6b8e94bd0c5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "fonts-gstatic.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'fonts-gstatic.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--034be14c-c502-5cdb-be66-ec77a89a3ad3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "forecastgarden.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'forecastgarden.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aff70c12-5568-55e3-9a47-9e61188736bd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "france-24.news", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'france-24.news']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b49cc7b-8c28-5c58-a9e4-eacf4db01238", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "gelora.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'gelora.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:amnesty-candiru-indonesia-2024" ], "confidence": 50, "external_references": [ { "source_name": "Amnesty International Security Lab", "description": "A Web of Surveillance: Unravelling a murky network of spyware exports to Indonesia (2024-05-01)", "url": "https://securitylab.amnesty.org/latest/2024/05/a-web-of-surveillance/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--86ec5bb7-bda5-5c8b-8449-4394cacfb198", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "genderconference.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'genderconference.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--24c0ec3b-4f69-5dca-a520-98247fcad567", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "goatsandals.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'goatsandals.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b0b2e83-d654-5e9c-a8c0-2ba47e442773", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "golfconcert.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'golfconcert.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--13e52c13-ba2e-503f-b27d-017908de1ab7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "googlplay.store", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'googlplay.store']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8e75c5eb-c234-5793-b37c-d063b6415a96", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "grayhornet.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'grayhornet.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4c5cee1c-0add-5a43-869c-9c8722c1b74d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "groundbreakinginitative.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'groundbreakinginitative.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--81844542-9035-5b52-9a5f-0c6be466b067", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "guitarcalculate.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'guitarcalculate.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e8fd7d75-9156-5c54-8f0a-6439b583aaa5", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "hetq.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'hetq.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8d68c0b2-cf31-5f4d-bea4-e00888a310ac", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "hilocake.info", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'hilocake.info']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2829db85-28fa-5d13-b9f4-1afb85637a14", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "hostilefauna.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'hostilefauna.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bd438c18-912d-5a24-b081-5a83afe07585", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "hotjar.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'hotjar.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9dd28096-b970-5571-b0bf-96a6d78ab668", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "hraparak.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'hraparak.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c1a66ddf-6f8a-54ee-a20d-83c2bfeaad57", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "indoprogress.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'indoprogress.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eea8fd38-d52e-59f3-8e54-bb82526eb275", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "infinoas.mtrtb.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'infinoas.mtrtb.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4fb61cf8-23e9-530b-884a-9b5796b1045e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "insightenterprisells.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'insightenterprisells.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8ffb8def-e203-532e-a2e3-916a13ad2640", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "instagrarn.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'instagrarn.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f2307656-7da8-5aef-8075-4604b48f0b15", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "isolatelecture.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'isolatelecture.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fd13bc71-265a-5788-9436-09d91167eae0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "jellybat.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'jellybat.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--96741a74-b648-5709-8aeb-54b77bbd7a8f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "jobmarcher.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'jobmarcher.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--70403fd4-1d66-5ad0-a69a-d86b9e49581a", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "johnshopkin.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'johnshopkin.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--62b7dffd-489a-54bf-923b-d71af6653495", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "journeyjest.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'journeyjest.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d17f1380-ca54-51be-932f-c270f899d95e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "kartingrumble.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'kartingrumble.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c72528a6-0bf4-58d4-80f9-1207e30bf7f0", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "kenoratravels.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'kenoratravels.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d5d059b9-b976-5e0e-ad69-8a9a11a50d4e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "keyadapter.com", "description": "Candiru validator server. Profiled a device and decided per device whether to deliver an exploit.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'keyadapter.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:validator", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--13f429b5-8cd4-5afa-ae84-96b582761ff9", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "kidone.xyz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'kidone.xyz']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--14e94cda-2c7f-5eff-849a-3233ca834591", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "konferenciya-zoom.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'konferenciya-zoom.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a7ce87c0-34a6-5b14-8fe3-96f9fbe361a4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "kupony-rohlik.cz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'kupony-rohlik.cz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--868679c3-b2f6-5e76-939c-6e4bdc4da9dc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "labyrinthextravagance.org", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'labyrinthextravagance.org']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3e245c84-37d8-5101-91e8-ace71339b683", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "leafconfuse.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'leafconfuse.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a3de7bd6-fe03-5ea1-8ca9-db608594b8d7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "lenovo-setup.tk", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'lenovo-setup.tk']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ab2c9806-3f32-575e-a7f4-f9d4a76d3acb", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "lessonhandle.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'lessonhandle.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2ecd2702-a304-5923-b5fc-2b99c6d26f90", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "library-update.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'library-update.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b89aa87a-e551-5473-8d12-d44242508342", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "linkedin-jobs.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'linkedin-jobs.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d7c1df8c-cee7-5444-b446-833084af91d8", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "lioiamcount.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'lioiamcount.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--84000c45-aef6-557b-9276-ecbe3b07a6dc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "livesesion.bid", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'livesesion.bid']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--919a6996-96d8-565c-8332-dc91bc83c821", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "livesession.bid", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'livesession.bid']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b30ce7c0-75c3-55dc-b6a3-9b2f968bcca2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "llink.link", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'llink.link']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2ef10a92-6aed-5232-a9f6-9e72c48cefd3", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "lragir.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'lragir.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4988b2d-1b67-559b-a9f3-f632dce1d205", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "lwaeh-iteham-alasra.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'lwaeh-iteham-alasra.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6e74160d-09f1-5864-a014-b2bb82a0839c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "macrodrop.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'macrodrop.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--62fc0d0e-f1a4-5e7e-bad4-46bfbb631d4f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "macromint.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'macromint.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cf1dc887-1669-55ab-82fd-80e461e126ec", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "maturitygenesis.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'maturitygenesis.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cc37a1c7-1e16-58e8-b0db-feca148b44c5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "mbsmetoo.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'mbsmetoo.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--93bd0593-733e-50d2-a3a9-d77a66be9818", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "measurecabin.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'measurecabin.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5759ac63-74b0-517f-a649-02fe1b627123", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "medica-tradefair.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'medica-tradefair.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f4172421-03f0-5c2a-806e-a2120969a714", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "minstagram.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'minstagram.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8cb67b17-4447-56fc-9a8b-2f7148fcbb3e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "moatads.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'moatads.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f0ab3196-8fb7-5557-b195-1d2025aa3d24", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "msstore.io", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'msstore.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aa96f2ab-6deb-5184-805b-31c9063630df", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "mtrtb.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'mtrtb.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--35f31504-8166-5407-b511-ad485891d5b6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "mushroompalm.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'mushroompalm.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--04caf740-451d-5ea5-8c2d-fd65a5dc46b3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "mydsp.io", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'mydsp.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a775530-da09-5d63-bfec-3f3a18be1310", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "myipinfo.io", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'myipinfo.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d8397d2-70e2-5eb6-9af2-c4e18cb4eb4e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "myweb3id.io", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'myweb3id.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--741332cc-9dc3-5f36-8317-4df49b9eca56", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "noas.adtimizer.co", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'noas.adtimizer.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b1f6c7a0-9b92-5355-a4c1-0ee16ec1a2af", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "noas.impchkdsp.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'noas.impchkdsp.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c89241fc-c230-58b1-8349-e8f6668fe2c3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "noas.mtrtb.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'noas.mtrtb.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2f269832-8553-596d-bd6a-cf1a2d020813", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "noas.powerium.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'noas.powerium.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4d0f7bca-fdc8-5b99-b488-4ddd570b9cee", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "noas.trakking.co", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'noas.trakking.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d9530068-6c30-5bdd-a26c-48c6b0aa151c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "noc-service-streamer.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'noc-service-streamer.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1df0d257-446c-5d91-9143-3249173e2dcd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "notableexam.org", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'notableexam.org']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--14c0ff99-0741-5df5-bd09-17d829245f6c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "notionnowadays.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'notionnowadays.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--efa1ba88-9007-5599-b803-67a8f716f2fe", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "nusantaraqurban.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'nusantaraqurban.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:amnesty-candiru-indonesia-2024" ], "confidence": 50, "external_references": [ { "source_name": "Amnesty International Security Lab", "description": "A Web of Surveillance: Unravelling a murky network of spyware exports to Indonesia (2024-05-01)", "url": "https://securitylab.amnesty.org/latest/2024/05/a-web-of-surveillance/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--957ef285-db0c-551b-8332-0e7fc80dcec8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "nutralove.co", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'nutralove.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1cc11055-f79c-5034-9178-58fdabcca73e", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "online-affiliate-mon.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'online-affiliate-mon.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8af30686-59b2-5049-87cf-3b89cdc31a6c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "online-source-validate.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'online-source-validate.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c3c7bdf-4f1e-5d9a-aee8-a268fb59088c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "only-music.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'only-music.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c2d01fe1-a093-500b-8344-e99b01952ba8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "osesgy-unmissions.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'osesgy-unmissions.org']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--46098238-fb08-5a2f-b19d-1c04736bafd9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "outdooutcome.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'outdooutcome.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--00bcc7ef-66e8-5913-b6f4-4368bf4a570c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "pagead.trustlayersdk.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'pagead.trustlayersdk.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--410ff6fd-3c9d-5f5c-980b-dd8ced2949c3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "parkourbus.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'parkourbus.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5619a82b-9828-5a25-b349-1d8287302c43", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "patternperiod.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'patternperiod.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6313e7e9-7e7a-53b0-971a-3f283094bd68", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "penslice.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'penslice.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--117236a2-bf04-5295-b910-4e8d1f085ff0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "pepperdominate.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'pepperdominate.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e06bbdd5-0d1c-5c3b-963f-147c759254e1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "piwiks.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'piwiks.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--03726c36-6879-59d6-828a-2d0bf0716ee1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "plasticbells.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'plasticbells.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4a3e77b6-55ac-5bd7-868a-cbb6e7336529", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "platc-tester.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'platc-tester.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c0f23bc-2e3c-5762-a444-6aa89b9c1299", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "pochtarossiy.info", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'pochtarossiy.info']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8e1ac5f3-ad37-53cb-b106-32caf78eb59f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "popsonglist.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'popsonglist.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8fc7049d-16c6-5d85-89e0-8ef633728665", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "powerium.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'powerium.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ac8653df-82a5-5df4-99e7-0c68e3cbb67e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "ppv2.mtrtb.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ppv2.mtrtb.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f35772c-19b6-563d-a714-4596e6505cf7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "pqv2.mtrtb.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'pqv2.mtrtb.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3c072885-5880-542d-a6e2-623d23c42d21", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "prawnbasket.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'prawnbasket.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cb51fb7e-0054-5fb7-bce6-b34f3827522f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "predictproper.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'predictproper.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9a475a17-eb08-55cc-9cb9-01063d37cea1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "pressaviation.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'pressaviation.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--56cc3ff7-f9ad-5ed2-b287-df82210fb24b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "profligatecensure.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'profligatecensure.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--81695c83-2f8b-5ea5-9fd2-a30d1d86bf65", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "qa-noas.powerium.net", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'qa-noas.powerium.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--615022e1-e0c4-5c08-ba19-93cfadd4fed8", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "querylight.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'querylight.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9314fc8c-5ddd-5d14-8b22-59c222e1e3b3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "rasef22.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'rasef22.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b41e0316-0a12-59cc-9312-a252d0a5a1b2", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "rbtlnk.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'rbtlnk.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-catalangate-2022" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru (2022-04-18)", "url": "https://citizenlab.ca/research/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--98988520-ebe1-5aa2-8af7-6b87f99bfb8c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "rebrandly.site", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'rebrandly.site']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f31428d9-b6c1-5ed7-908f-266c1d95dd7b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "refugeeinternational.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'refugeeinternational.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c48ff11a-8dcd-5ec3-b9b1-f5c893d2d41e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "rollstrech.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'rollstrech.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b600e8ee-7b04-589a-bdd9-39d6c7c6afbf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "romancedrum.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'romancedrum.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--214a1816-1124-5a4d-8be1-4e0cd6cfdbb4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "sacrificeprincipal.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sacrificeprincipal.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b5e26bc5-4342-51be-b270-1cbf4973c47a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "salmonpride.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'salmonpride.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3e9e4b57-5b90-5e3d-8eaa-2c974be7866f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "scoreparade.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'scoreparade.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--15f69e82-2ca3-5dfb-91b5-5893c10fd85f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "selectedpazzle.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'selectedpazzle.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c6b3c44d-f8c2-5d24-b0ae-6582b5d2f4a3", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "service-deamon.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'service-deamon.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--10956a59-9c33-5cee-81db-fc57566dc137", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "shareitwork.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'shareitwork.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--71a4731c-9480-5bb8-9985-fe5da3d498ff", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "sharethere.net", "description": "Candiru validator server. Profiled a device and decided per device whether to deliver an exploit.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sharethere.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:validator", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dfe56b9d-c697-524c-ada2-bfe7a75368e5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "sherathis.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sherathis.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0d77ef8d-9653-5bfb-a461-b9aa7ffe1d28", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "shortlinkcut.link", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'shortlinkcut.link']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2b589c17-ca1e-59f7-a9ab-b6c1c18a3b49", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "signifyslight.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'signifyslight.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--36b874d5-e7f2-531a-bec5-d1376313683c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "sincereaccertain.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sincereaccertain.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--90518617-de20-58f7-bfb4-1cac6f5e6e67", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "site-improve.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'site-improve.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7121aaed-514f-5467-9ffa-ce2a1af997d5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "sitei-mprove.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sitei-mprove.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0303f400-7296-573b-a5ee-3c54595586a9", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "smartstand.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'smartstand.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9c0f4c1f-e58e-53e7-a8eb-24bdbe0949fa", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "spongefruit.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'spongefruit.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--10759b97-cf0a-5e29-a4cf-1d101ca15f5e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "stablesurface.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'stablesurface.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eda07e36-93d3-58b0-955d-28599996ba66", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "stat.email", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'stat.email']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-catalangate-2022" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru (2022-04-18)", "url": "https://citizenlab.ca/research/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4db1bab8-3f3e-50c3-b2bb-c96033fb4711", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "static-doubleclick.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'static-doubleclick.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8392a57a-66f7-5d1a-a958-d4cdc177d47c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "strangegarden.org", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'strangegarden.org']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--84a4ff9c-810b-533c-9afc-0d003d871ac8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "stylebrakedown.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'stylebrakedown.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--41ed7ab9-d490-5f23-8b8a-0a781504bf9b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "stylishblock.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'stylishblock.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3ab7871b-d27f-5acd-8e9b-a776a78112e7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "suggestutterly.com", "description": "Candiru command-and-control server. A connection to this is the most serious of the indicator classes.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'suggestutterly.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:cc", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2d6c0562-dc17-507c-9708-d181ef76581d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "sunsetpotential.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'sunsetpotential.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--64f0cd80-1ba5-5e89-a69a-4fd767d458d1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tacticscheap.net", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tacticscheap.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9778709b-b0c9-59f7-a208-2fc820cf8a3e", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tehrantimes.org", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tehrantimes.org']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f281aebd-3d76-5686-b68d-ea01552c4769", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tekma.adtimizer.co", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tekma.adtimizer.co']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a3dc4457-dc84-57b2-8769-407b8e1921e3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tidalscreen.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tidalscreen.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1fcd795e-c9c3-5e21-aee7-4ae24ce63210", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tinyurl.bz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tinyurl.bz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--46123374-4e41-55c8-8f12-e8ca399cdd7e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tinyurl.ist", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tinyurl.ist']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2fccdebe-4ec0-5303-9a33-6751de73fc9b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tinyurl.one", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tinyurl.one']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a914a69b-b2b6-5ea1-83ce-89ae94b035c7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tinyurl.photos", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tinyurl.photos']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--762a0a46-ff1a-5e2d-a254-50488b49170f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tinyurl.plus", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tinyurl.plus']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--83176ef7-8b68-5f1c-9c79-1202bc0c503c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "total-slovenia-news.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'total-slovenia-news.net']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--11c0a215-aad6-5011-9412-69160b3bbd3d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tracker.mtrtb.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tracker.mtrtb.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a2a7ec44-8815-552a-9846-47d2208a05b4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tracookiepixel.xyz", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tracookiepixel.xyz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--accdbf02-24bb-5cf2-80f9-e139c6acf07e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "tubeshape.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'tubeshape.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--896a72b7-9773-58ca-a04d-fff01110fcf4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "twitt-live.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'twitt-live.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c84b432e-ac23-5cbb-a134-ff1c6c300ca4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "ultimatematter.info", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ultimatematter.info']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--045d07e9-c17a-5104-b51a-730788e6bfe4", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "un-asia.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'un-asia.co']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--402c630b-d528-58d6-a60b-c741a54af940", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "url-tiny.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'url-tiny.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8425539e-d8c8-5993-bb3d-fc9d3fc2b6ac", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "useproof.cc", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'useproof.cc']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7b078a1c-aab7-5edb-960c-c3616b8e6e32", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "velvetpremier.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'velvetpremier.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dabf95a3-adbf-5405-ad71-457755157295", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "vesteldefnce.io", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'vesteldefnce.io']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d7771d8c-ee4d-55a3-9c72-a849c9f72296", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "visitortrack.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'visitortrack.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e584b29b-2671-5f79-a0cb-725a5fad3ffa", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "volasim.com", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'volasim.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:citizenlab-adfection-2026" ], "confidence": 85, "external_references": [ { "source_name": "The Citizen Lab", "description": "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (2026-10-15)", "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a61e071b-f48b-563c-9466-25bddc3e9068", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "weathercheck.digital", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'weathercheck.digital']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3804de28-ab70-5bae-8446-68f07d0af3ee", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "webfex.bz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'webfex.bz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f1d7a6e1-4794-5b70-aaa8-0850b6d44bf2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "webffx.bz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'webffx.bz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fffc6e9a-f6cc-53b5-ae51-39dfa60f7aa8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "webfx.bz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'webfx.bz']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--25fbad9a-e284-52e5-9a76-1aaef782b84a", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "webs-update.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'webs-update.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:avast-2022" ], "confidence": 50, "external_references": [ { "source_name": "Avast / Gen", "description": "The Return of Candiru: Zero-days in the Middle East (2022-07-21)", "url": "https://www.gendigital.com/blog/insights/research/the-return-of-candiru-zero-days-in-the-middle-east" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f4df5517-76d3-55ee-9689-5f6080788a06", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "whoint.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'whoint.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6feaab7b-e51d-5e0a-8bdf-a7db19bf6175", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "wikipediaathome.net", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'wikipediaathome.net']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4c40c5b0-e44e-5868-9a6d-f4d24c21ed3b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "windomination.com", "description": "Candiru-attributed server infrastructure. The source lists eight clusters mixing victim-facing C2 with higher-tier operator infrastructure and does not state which role this domain had, so the role is unspecified. A hit is serious.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'windomination.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:candiru", "confidence:primary", "source:recordedfuture-2025-08" ], "confidence": 85, "external_references": [ { "source_name": "Recorded Future (Insikt Group)", "description": "Tracking Candiru's DevilsTongue Spyware in Multiple Countries (CTA-2025-0805) (2025-08-05)", "url": "https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--221208df-ef02-5dff-b382-a8736033c5d5", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "winmslaf.xyz", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'winmslaf.xyz']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:microsoft-devilstongue-2021" ], "confidence": 50, "external_references": [ { "source_name": "Microsoft", "description": "Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware (2021-07-15)", "url": "https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f54890ac-a6a8-5546-a3ba-63f15e7b597f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "womanstudies.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'womanstudies.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c7f3b59b-48ed-5918-ba29-1d0f32ceb6e4", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "wordzmncount.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'wordzmncount.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--209b4129-1303-5461-85ad-84a46a84a31a", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "workaj.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'workaj.com']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:google-tag-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "Google Threat Analysis Group", "description": "How we protect users from 0-day attacks (2021-07-14)", "url": "https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2e692e30-c938-52d7-9538-9b8e4d40f6be", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "www.discover-tech.io", "description": "Discover-Tech / Controlium ad-delivery infrastructure. An impression from this is NOT proof of infection — not every ad carried a payload.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'www.discover-tech.io']", "pattern_type": "stix", "valid_from": "2026-10-18T22:33:48.000Z", "labels": [ "tier:delivery", "confidence:primary", "source:confiant-adint-2026" ], "confidence": 85, "external_references": [ { "source_name": "Confiant", "description": "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (2026-10-15)", "url": "https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6bdb2de5-9ae5-5e2a-b15d-62bd65e66591", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "yektenet.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'yektenet.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:eset-swc-2021" ], "confidence": 50, "external_references": [ { "source_name": "ESET", "description": "Strategic web compromises in the Middle East with a pinch of Candiru (2021-11-16)", "url": "https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5f648485-bbc9-5256-bd48-2212fa9aab30", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "yeni-safak.com", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'yeni-safak.com']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--05411c1d-ad4a-5d2c-94f9-7d903698fc58", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "youtubee.life", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'youtubee.life']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ae0f3355-4c90-512c-8cc3-7128761d4367", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "created_by_ref": "identity--294ec63a-c449-5439-83fb-942185697747", "name": "zcombinator.co", "description": "Infrastructure attributed in older Candiru campaigns. Interpret dated evidence in the cited report's context; current ownership and activity are not established.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'zcombinator.co']", "pattern_type": "stix", "valid_from": "2026-10-18T00:00:00.000Z", "labels": [ "tier:historical", "confidence:secondary", "source:citizenlab-candiru-2021" ], "confidence": 50, "external_references": [ { "source_name": "The Citizen Lab", "description": "Hooking Candiru (2021-07-15)", "url": "https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a452af6e-84bc-5189-857c-31a67117b04a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--74b8e458-3dfb-5c8a-b187-8b25a1a6a071", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--175f0237-7443-50b9-b818-ba8831d879c6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a706cd83-7ef4-5734-be39-6621f183c5cf", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a303cb7c-bc54-5ffa-9331-8a0b245f89df", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--dd16f702-8fdb-503f-acfd-2a6a68ee2da5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b0f85fd9-9cc5-5633-895a-4b435a207aa8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5b899b27-9513-5138-a76f-e179b1bfc84c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4941e1ab-98b3-5e2a-ae03-d5157e1e18ef", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ca6c0518-f307-598f-9a8b-07ecf951b8dd", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b995b78d-5098-59b0-ae97-8f34d50e5443", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d3302b7a-4792-5188-9240-5bb890f0c74b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc962661-bf16-57f8-adb7-80eb875249c4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--30164156-f885-5f34-a487-acc0176efc97", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c38dd4e-045e-588e-b951-cb8d0f51dc0e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2ea7e1c4-5a0f-5754-ab41-2e4ee3089bf3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7dc7142b-c7be-5ad0-b571-b31490cc8b38", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b7719b9b-d659-5882-9921-da07d189133d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a2221782-7e36-555e-8626-45ef299d034e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c43c260a-4ce9-5a85-8ac4-974d0b307e99", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dc8eacfb-b6f9-5f1d-9b02-58d728ccf941", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3b23217a-27a5-5513-a568-6aa594c54f25", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b3f1653-1109-5286-a005-3f917aa65629", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--734bdb5c-d3da-5d9a-ada1-369bc67c098a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d18542db-ed26-5710-8b3f-4d63ad582a05", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--97eaba41-e7e4-5d9e-afe9-7e3ac4a0490f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d63cb8d-e4a3-5f09-b0e2-fa349fffaba6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--20b7f35a-703b-5713-8a68-29a8374329db", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--473bfd4b-6bd7-5e91-9455-4b31654dc4ba", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--364a1d3b-aed3-5f06-bdf2-c0c8d6b15b18", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5411d63e-1cd6-576d-90a1-2d9f18c8ad9e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6fb0e044-4dc9-5f5b-a984-9e6f705fc8af", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4de4669-77a9-5d67-8baf-2a554a485e36", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--53f9fcbc-6c6d-5568-b678-83cefc77dd8c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f50f5507-66d4-55b6-a6b8-f2ae94e0a946", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7852f146-c6be-5413-9000-389aee47e361", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79748a5f-4542-5af7-b4d2-db71657c61e9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6dfd456b-7c30-55c4-a932-ce32c7cf8f31", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3bfdee0-ae6a-506a-b9c8-d7c0ffdd373a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1d98520d-938c-5a0d-ad59-2df9a1ec88e9", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d598817d-22cd-592c-bfc0-fdbd6ceeccfc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d1d1bdd6-6924-5363-9eba-b2a7d4f69a05", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--270ca109-a54a-5ad7-b53d-97971db73c4c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--122e9a9f-b108-5d02-9603-78952d79d37b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5061ecb3-a200-5cb3-b569-7ccbd9d38952", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--86d118d5-d8aa-5981-9a1c-a400159d5b87", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c3c3839c-03cd-573e-9f23-53015be64b09", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--283c360f-94d6-551c-8129-eb013acdea9d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--404a1aeb-7baa-5342-bbca-8e146577ac0f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2c4f0866-02ed-599e-bec2-76dd17f42edf", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c714b371-f1a6-5853-ab23-b6e0d0acea60", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--45ad95ba-c815-51e6-ad4c-83244e545325", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8cf36a5b-e7f2-5a99-90af-847c1463f4a1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7e7a7983-e430-53c0-83c7-90eea3dca0c6", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--06312523-c18d-5fe4-abce-9fe9ed826850", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f3285b0a-a5c9-55b4-be7b-ce4dd027f074", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1e9ba030-1e8a-5c04-9a33-d0300972b33c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--20c5adde-23eb-549d-b83f-758766367b22", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--850c5778-a50e-5e9d-8d91-5aeb6524c9b1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--38c57dff-53f1-595a-b8b5-5b8b2a6df1ec", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7afdc595-d85a-5061-ba83-c74a1f9f85a9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--921102f2-a3b8-550c-89a7-5cde42d07f43", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70447004-30cd-5176-86e8-0f44ea9ac8a8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--473da9ec-128c-5c82-96ab-f9b8aac1db2c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3ef8e27-34e8-59a1-ac24-307516f5832e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a6908b38-c346-5f2c-b55f-ffd529bca9d7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e51b9b0b-2511-5a14-8467-1436a09c4b96", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3cd1461e-c129-5199-9330-100c8b54ea8a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--49e44c41-cab5-5fc3-a4fb-f99519d75ffe", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c7b88823-7b76-59b3-918e-03794291ce49", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b90a024d-3072-5ec9-8d31-ff23e3ae5a6a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9c5a8f5c-13bf-5448-b93e-3c2a43d8017d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40eaea7f-ba13-570a-91f8-3d9eb9107c2f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--586e080a-5f89-5ba4-99cc-86a5e57ddd3a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e2a1e32b-4bf4-574b-9477-29b05a539815", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0fcb8093-a1ff-5b59-a391-65a70ec0301b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0305177-6d54-56f0-88d1-70d836e43b15", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--815e80a1-8d66-5c93-9f37-c557e33bedf5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--992e23ed-a81a-5727-8b2c-fcaabe7995fa", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f9282a37-6dcb-5193-a698-ddf4f549ae22", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--05f8b2d9-238c-530c-bee4-4a50b3154e08", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4cf0d954-cbc5-5d0a-9b1f-7c611a6ddb76", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d7f42ec-2a1c-5be4-8d87-b2ea454c4748", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a201cac6-569b-54aa-bd7b-bf4b4f29fa40", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d91e8dec-caa3-5e6d-9923-c7d862112234", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9994332b-67df-5f81-8781-1441c49747e7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--514063bb-7345-53ca-9d8c-f3de79f3ae37", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ef161103-fdab-5eb4-bfc9-7c58f6e48671", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eeff52f5-1db9-59a6-8ca8-cd53765d9883", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--424cca24-e23e-5e32-9dda-86f5febc5a30", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6367e32e-c46a-5805-a857-cae4fbe57576", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ec331b79-9cc5-51dc-99a2-49e9270ab63b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1558a8f3-24ed-555e-b889-5dff79277f0a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c4f8708b-a083-5997-9f4f-2aa5c2a3c65d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e3c0faa-5a05-583e-b0f3-c3c45ee3c68c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--325e86f7-45fa-5006-b59a-3be44d7fe2b1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c79cc8a-9cc6-5871-a962-e032bee9b597", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1ce4d207-1206-54df-a574-62e0c9205ed5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--730249fd-19d6-5088-969d-bead6f7b63f6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ba6fa81c-d5b8-56e9-bca9-40db86aa2444", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ac6046f2-7164-5e55-b60a-a75bf18df9d8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--09d0df16-c5fa-57c6-8bd8-cf0978005b42", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62764400-dc7f-5c8d-bc61-4b211c398086", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--98b7cc3c-cc5b-5a64-8ba2-38804bb04068", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fe602c37-fc3c-5847-8576-f0702dcf8913", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--aed0e4da-c6b9-5fe7-b4bd-467d8796f445", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f59af884-ad40-51d2-84fb-e38461622f41", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fe9895cf-a21c-5848-9ebe-c9cba4aa5b70", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ddbdf1ae-20a6-508a-9d3e-c6a8e186f991", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e81acee1-9a50-50a2-91cd-f30604cadb1c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ab9c76fe-eb3b-50ff-9cfd-aa68c325824c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--07b68cfb-69d6-552a-8cc4-5ba6a631c355", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3a561ce-a7f4-55e5-aed1-d5917fbb068b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--dbb8446a-534b-5370-9283-81f4120ec437", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f2144f1-744b-593c-b45c-d5a39af2b22c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3fed1d42-6019-5542-8d59-02d65a2bcd0f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8cc4b5a6-ac6c-55f5-ae05-2197ad6d20ff", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--65fb5a3a-0c07-5553-92b5-6f2fad82a632", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d6fde43-4d17-5be4-ba9f-3d628f1a38e2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f82a6982-3f3d-5454-8cd8-1a7632aeb3fa", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0656627e-7fd5-5cf9-a674-44c5e9ea5505", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1466e0d2-ebf1-5815-9340-843cc89b646e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--63032966-43d5-5100-aca6-be21f73b4db9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--cce1e199-4417-586f-bdee-6ec1671756b8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec444e12-a172-5338-80be-e7d75402ef50", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--80cc0359-6559-513a-881d-fd03be26e8f6", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--15108526-39f9-5035-b0c4-fdab476006d2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--81532265-3870-5a50-8a97-a8ba748c6b87", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e9ca7f6-ecdb-5494-bcaa-1cbf834d1b35", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f6c2b960-2490-545c-aa52-2bffc21aa959", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f679c00a-a557-57d2-89b8-80d34cc05e85", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1f57ae10-c153-56c9-97a5-dd976173afb1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2beb870-be69-53d8-b7b1-707c943a8818", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5aa9ef46-9a37-5de2-ac7a-223d73563c66", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86fbd74a-58ba-5239-82b3-b87989878301", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--759709a2-a08c-5647-90ca-482b48f69cd4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3c13577-4419-547c-b744-48ef50f617c8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0889601a-7d30-5767-996a-34c094d46af9", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--55f252b8-ec1d-5b7f-993e-2094a8abec9f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c1d9cd96-fd92-5254-b65a-4cfe3cf0b6d8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3c76984-e97e-554b-9415-10b559aeb02d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a3db8ab0-ecb3-579f-b7b6-0181e8021452", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2829c1e-f15b-5f6f-8d17-f7f03928b556", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7d43cabe-b445-51c7-93dd-3c1d50e6129f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b8bb6e01-f145-54b3-a735-3fe5cf21cbf1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--783ca176-1828-5f2f-817c-4737dd215278", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--45298a47-6e59-5b9f-9fa8-f7588780033a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--96b1b765-a198-570f-b877-518f7377f6ca", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c137da9c-59cf-5656-96c0-43b9b73c0ae4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--dffc34f8-a52b-5797-81a2-914546b97922", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0da69994-848d-592c-b881-ce8714090a25", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ecf9c6d1-ac93-550b-85b6-7c2b51614c3c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd40ebd3-896e-559f-9725-209f5ae361fc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ed5c4b82-e9fb-50c4-874f-67514ccc8325", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e4c317f-351f-5f11-903f-b5e3d8030b07", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6e095799-48c1-56c4-95f1-7d95ea83cc7a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d41629de-4286-51f0-bbc0-152285596d35", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--db6d3de8-743e-53f2-b197-1df444fc4ae1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6d0f48e-d52b-53ed-b589-3322c6a5ae95", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5b4442a4-d367-57f8-9e15-7fccda83b387", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a7a1fe93-ab6c-5dc6-862b-341a15c38867", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9707fff2-91c5-59f3-b8e0-e7e58ff22d02", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fdb7d452-7bd6-57e4-a97a-8e772387567e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c75c1014-a327-59cb-b568-dfbb03726b49", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87833e21-dcdf-5586-a6b3-a4883ad3871b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--264d904c-1f74-53e4-ab9b-d3bdf123100c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e303f0fa-48a2-5e56-9639-bd3b0eeb0c1a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--697e041d-4145-587a-96ce-86e1a6f91513", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--afb3003a-cd04-5b36-bc52-6d3fb172a788", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--602eb27f-640d-5013-b84c-0772eff99f2f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aa410bd0-0ce9-5ce2-b59f-9910f259d7c0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9a219b0f-fde9-5955-9e52-5104cb0197c8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f7e23d2-d7d2-5885-93b8-c109f6e2efe6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1f804b9f-ff42-55e2-a50b-b8d0e72eeb48", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79e2eb18-2474-5ab7-b10b-6980f7429bdd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--14c458ed-e035-516f-a05a-7b06e880e8c8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87483861-ab59-5b05-b7b3-044a2ce88c81", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c56873ec-da79-5723-98ed-935cb7645f2c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7e82fe2a-5369-5c38-b42c-06a77597d293", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c1ee157c-8879-51f1-93bb-a38d242b408f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c284af8-c996-506f-8827-208dfdc2932a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d716862f-e0c8-5641-891a-81664a5444d2", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aff7f747-eda4-53c5-93a8-fb13cb653e60", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a3cf78d1-aedb-5cde-b5de-85912418bd7a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58d81aad-b8fb-5e76-82fc-c1bc7238e50b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e9e09667-bd4e-5935-a9ed-d695ef2e71bd", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70ee78ab-db74-5405-b945-30139205981f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3eb861c4-18f6-5e10-9876-8819e6e912bc", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--830a487f-dc5f-556c-ad82-ecc76f701a07", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--953e8da2-f917-5e5c-a90b-424d46466b2b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f176de6-717e-5d0a-aca0-a1d2a37749d6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--06699a72-b150-5f62-bb06-50b955506307", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--08ec7339-ae77-5741-9003-e09eb6eaebc0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--13077d18-3007-58e9-a16e-be3b10516172", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a0cff82-ca43-59c8-9df1-01611ec245dc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--125aa7f4-26ee-5378-9dbc-d791f2fa7654", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--12254cc2-124f-512c-b724-7bb59c9de4f9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8c3f1bc8-f3d6-5933-9436-d491a753661a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87376605-9157-5743-9092-2a34f6c6bf7b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9d8af6b1-c088-54af-9119-c1e10647bc23", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7545d1fb-8a70-5a1e-bcd0-d9847370496f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9c6d3357-0678-5402-b490-93770cb17f30", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--381374bf-9ed2-5394-8daa-befd95b81f9c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5197cb55-ed9d-5b83-a075-0f4f3ac745ae", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b266c0d4-b98e-5a40-b1ca-8194c6c8215a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b9e04445-ff86-5bfa-90c6-3e3216575c7e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c5776f1e-91c2-562b-8ff7-081808e12552", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--50d049fc-28bc-5fa5-aac9-e1afc2dfa66e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b4c0323-232d-5be7-9819-a6581b3221d3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fea94816-4fb1-58cb-a215-26685b235778", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce5dab3c-05ab-5279-ae01-1af692d4e3a1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--cd8853a9-bd58-57da-9daf-c0d045ad1d09", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7223a3c1-c36a-54fb-b6dd-afe6acc0dcb7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--626ee39c-1876-527c-8033-f583cb96b4ac", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aa08b627-c980-5870-a97a-3c38b570f039", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2c4fd1ed-a040-5344-982b-b3a5b00886a3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb59a148-786d-5ed2-b08f-48f2f0966f04", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--145219c7-0b5d-53d6-9665-2cf1db49142b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c868c56-e51d-5762-a102-9df42745efde", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b24726c5-9b1c-59bc-8757-b6ce99bd108d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9b32c16-d8de-54b2-b885-b91f88bc9a8a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--639b840c-8918-56db-8d09-9f202e76b370", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--18c3a236-8d1b-5378-8c6c-31401868810c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2397465c-debc-5c7b-9175-868c9dac4f3b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--11f59b95-ae4b-59d2-9814-71b342036002", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--60f5ef60-16d8-5da6-a772-0334c54f2d82", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ff90643-0985-5223-898f-67255d1a274e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--988c09e2-5a2d-5105-ab35-880089ba8f29", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2e73c961-3fa6-5a3b-ac65-886fddc7e8de", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3baf930c-b6b9-5853-9f24-621cfde2876e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--95493464-84ee-51b4-940f-39c04beedad4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--10656dc4-6490-5f0a-a046-8010cd9bed7f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--41417d1d-14b3-50c2-a24e-f6f6fbf45b70", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8566c6fe-a3d5-589e-b1c6-29a505838528", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2f0b7b85-f729-5b10-b5f5-edb3306371af", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8a8b8c23-dc1e-55bd-82f6-bb627413ecb5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--18ee8587-30de-5682-8941-0f4e7c7b4138", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9b40e4ce-b130-5635-b5f6-12bef024eb36", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5526e0d1-72f0-5f50-bf36-b10c28e6eebb", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d50ab501-67af-5d20-9ae3-050d563384f3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd2c0c31-d51e-5bf1-b26e-d312d1e03a9b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d8cff811-3de7-5597-a9e2-f49e95c9b85f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f95a6acd-9370-5a76-a456-ea9a240b1cdf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3623bcdf-ba0d-5d9e-bd03-67788f3cb4f9", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b7dde7aa-31c2-55dd-bb36-c6b432465933", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2e58598e-265b-502c-a90b-145786a295f0", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fbeb4c3d-0656-5ee8-ac59-8ba8abbc0bc8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fe87a3e0-b0ee-54ad-aeac-70b163937d85", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d5b5d21c-0d88-558c-9fb9-85db06ee0500", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--40e07b83-402e-528e-a762-ab31e133a1f0", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f246e767-798a-50c5-8e37-da2612dbf864", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3fe22e7e-08ae-56c7-885a-52d55c4bd831", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7cd3f056-90b8-5838-aeb1-02596bd572f5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5d2e3758-67f8-5a3e-92ff-c7b98f9ea915", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01733e44-8a7c-52f0-be51-999e71240f80", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--314e342e-b5cc-5689-aa7f-608b4f30c14e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38f72e8f-2392-52f1-a71b-d0df8c314a60", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6d07a0d7-9c72-5b3f-af90-cfa24c46d06d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--98c6267e-a1a9-5fe3-b267-8d8cd8ad813b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5624e7be-eb19-5136-b380-714b3fa7e95b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ef592a18-1cfc-5c2c-a696-35a43d8063b8", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4e84a08c-af8c-5648-8b34-517f11afe6ff", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e13de39b-398f-5eba-b84e-80b373d13766", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f15cb929-b882-5b61-bad8-46e1f9962b5a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6d235f7-2a6b-567e-8897-67d778505d61", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0c959e32-1cc1-57c5-9927-d34af036c4b6", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a74a9fe-a517-5602-96c1-3875fcbedc6b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--068d1d20-bfd8-5b42-a5a9-e27f8b5d2f12", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--68ef6794-dd94-5ad6-8222-01f2086a0fad", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e29fcbe7-02f5-52e3-83a5-3d442321ca29", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--27e2b29c-67c0-5e4e-bc2f-6234e30461f5", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--74b654e3-93f1-513b-a534-6792ad4e45b3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dcfa5e45-6635-516c-b49e-b8a27f57530c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e55b7fec-0865-59c1-8323-184e4a34c483", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7a5531b2-55da-56ef-a45c-fc41a1185b7c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0a106c3d-8e79-5aca-9301-5a5f0b792d28", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6879abf8-4311-5adb-8bb5-947168f7e4d1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5a7c2727-f428-5e2f-9546-d9c536b6baa6", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9434ef07-025e-5f76-8b8d-a64afcc73027", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fce6dd87-a10a-5a75-83ac-e394d253da57", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b8fcf4ba-e3e6-547a-8b66-0f4cd1c37429", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b485ff61-b6ab-5358-874e-5655b65ab8b3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--45440e9f-e4eb-54ad-8612-f7d37a69a068", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--cb97286e-b226-55f3-a09c-acb2a966894f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f848e757-4faf-5043-b7b5-ae4d115b0845", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8170af07-ac15-57df-b008-b00e771fb2a8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb2ac962-4c03-5d31-8ded-50cb32f70e61", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e88815ea-a7bc-5e1d-820c-d43b353a0d15", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e6013a00-2799-5d07-b5d0-1a1b513528c8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--73642a0f-2eb4-54fe-9ae5-8dfa564915dd", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--61ea7b78-2e95-53cc-afab-d59022b30baa", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a7732974-8a28-5a51-a06b-01e5219ddd6b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--019114ce-b9eb-557d-b0f5-aa8eb3df4744", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5c0f5ea3-4898-58f2-a449-7c9ca6a4651a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f2757b93-7254-50d2-a0c4-001e14819b51", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d5f20cb3-19d5-5c58-a564-293d6efb7554", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--31231c46-e95e-521c-b4e0-d9a11a0ac48b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9d53006b-6c0f-55eb-9c6c-b97e2c96bae5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c551a00-580b-5726-bad3-b664dd2562c7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1e1a1439-9f49-5563-97b2-63b6a8b49471", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--669ca24c-2b5f-59b2-bef7-e9f15b2aa16f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0af03a24-5e0d-5ca5-a2f6-d8b3be69d2ce", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5c04b314-ca92-5104-9867-6d3385afb8d3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--70eac4aa-63ce-5fc6-aa67-4f0f652f2a78", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--889096c8-edb7-550d-9998-3c9087be6f71", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--381e46dd-ac74-58d3-b54c-8f29646b4bb1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e179de13-b959-566e-a081-68723e20fc5f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ad43b3e1-dd4e-5190-b3cc-112d454fe378", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fbe9f2b1-d79a-5a02-bd23-4af37bf13049", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e8ee60e2-5360-5b99-bcea-d19151cee3bf", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8117d82c-b3a5-5545-830e-85f1771975cf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5555e634-cee2-543d-a344-c47742599cae", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--61b57c7e-20e2-571c-84b5-5081edf8817c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--633225aa-8583-5936-affa-a9f950093a36", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c6deb9d4-63ea-5678-bae0-4c0cf42790df", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f0335175-b0d7-5e3a-a2fb-f97198b2dc84", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b68c3e5c-870c-55a1-83e7-4f303f45814b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--38d6936b-d6fb-5e8a-911c-3ac0f91e390f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e6fcd03-12f2-50a0-a584-e29b01889089", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5e4921ae-b2b7-53fd-996b-3c35fed63a56", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--53750a7b-2311-598e-b124-4ac34951f868", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9cb2fdec-c6fd-59c1-b64b-8f2270d64993", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9958fd6a-b8f0-5cf0-bcab-f3ba5c4af9a0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--37e8331d-3c70-51ef-8592-035e64cb3a7f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd7f06b8-a8e9-5a63-9933-7656789fa296", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7e54fd2d-f308-56b5-9669-8d9d32f92501", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2d33ca25-9e39-58df-b191-725b34526fae", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fbd612d4-973c-51a7-adaa-b8558f9657f1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6fce912e-fc16-5ace-a5cd-bcfb0914e0a9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--28e7318f-6d70-582d-87b0-113d9d053f11", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93693ce5-413f-5041-939a-b2f24d283eff", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d13bb7df-fb3c-58b8-b4fd-543c34b592a0", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f7b6ae25-a092-5102-9682-371e77f64f30", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d2bfd22d-5ad6-53a7-9c22-e5a2dfd18a02", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce9c5264-e25b-5dfa-93f3-cf05772a0b93", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d8528e57-9b6c-5ff1-b94e-d3e2eca689ac", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a25de52f-c917-527f-91c5-f0247c08b13b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--93f01785-17ec-5e7e-89a2-c17c26b21c5a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5a689f63-1916-5795-9910-30c9d0234095", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b366063a-92c3-5614-af57-d1e40aac4858", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--425d00d7-8b02-5156-b3ed-bd135d3b1bb8", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4d6a1972-356e-5e13-8e95-6049d7f414dd", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9013b3bd-7b46-598b-9bbb-35562d4b7255", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f62a1619-9e26-5d40-95ca-527496299442", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5aeb0658-c43d-5620-9cea-d9dd1e6f8525", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--08e4577c-5a2a-5281-a434-c154096999a3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f134c27c-b74c-5d8f-8d8a-e36e32a39426", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--847caad1-0809-5654-802e-41664a29c4a4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50e43fca-d673-503d-8d2e-d45d149df82a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--15739160-0a0d-5020-9bd8-8b49da084209", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b2f1916-108e-5a27-9454-e61f614b20c9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5c2b93e7-4baf-5004-8856-a792e323d77c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c596a059-d044-5b6b-97ac-2df5f392ea25", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4030e321-22d7-53dd-8af8-7bd992841ec3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--414d76ac-d732-5937-b4c4-dfd5ff2d8dfe", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1827ff3e-4d6e-5ed0-a0fa-e6a22c5378ae", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f192838-6210-5f65-9cef-ae792ecc0ff6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--18fda003-8e46-5b6f-89d1-cedeef785557", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80585227-f301-5530-b83e-63346af18e81", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3f34990e-d09e-58e0-b4dc-8435959bbe95", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--983d8688-f569-5ab6-93e0-114abe4eb03c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c106f88c-abb0-54c6-913b-cd4797389d6c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2949bec8-5f1f-5bae-9e3a-6633b7cce606", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--443ccd83-0af1-5cb0-ab85-cd0b3b88a98d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36bf8762-6d87-5c24-b405-1345b1ba2d28", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b975b874-8675-53e1-9511-bcdcdd444b5f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cefca1ef-8d77-5445-8906-6e7bfecf086a", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--135cf875-540c-525d-8184-f758e843799b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--75b02dcf-cf3a-527c-a94d-62e086d4e496", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4b9c1e99-f84c-5fd1-8472-08bf2822ccb2", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c505b05e-49f4-5fcf-8de7-daef0aa36075", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3e404a8d-e5ca-596d-a45d-b8c2a0ae2488", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8385c2ce-d7db-52c2-831b-ac590adefe3d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f076b92d-5c84-5784-9127-420cc363574a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--81f60202-fd38-5997-a79c-3ab8ca326124", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e4186723-9847-523d-9017-be5ebf434254", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9002eb6-ab33-5341-a603-bdfde8a3a88c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5737d9d5-8674-506d-9498-cd6ac483c159", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f603f1d1-7e62-5301-83b4-c61d82dd04d7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e6381373-2238-577e-a0b9-cda9d8145079", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71796a41-ef5c-5914-bf7d-d1a990f1fe6e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6474b80e-1369-5e76-b620-f79fcca7d331", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c4d0a24b-bb9c-574c-b99e-f30ed0812096", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0663b862-e3ba-5c38-874e-66aa458deb82", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--48d50b11-1a87-59d4-bc25-dc3044b2ab81", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1c84ceb0-fe42-5903-9c24-7cb5b35be72b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da34b599-306b-5d75-94cb-3193d365b137", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ad146f3d-7905-5942-bea8-f3b7e9414f4e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9f4d56a-8ea6-5986-8a0c-ece0b2abcb35", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7618b9f7-b2a1-5a57-93cd-e3f675dc4a07", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a81e8de9-8158-5dd0-a0cd-f5b539b03586", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f454ef43-cd94-5f72-829b-2ceeb8016946", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd679735-ad8d-520a-a8af-6b544656a59c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--62fd37ec-7e77-56a6-beab-af60413482d4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8d5536e7-c821-5919-a296-12abe4c863f0", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4b509ac8-bcf8-5f97-ab3a-dbcb6ad72810", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b252a8b4-4c55-5221-910f-4482451672a5", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--04c3f043-bb15-5ec8-9e7c-4cacd222a47c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99e9f420-2c6f-51e5-b5c7-02d6b637e7ca", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6f1ca82a-f398-5508-9db6-954f0f700497", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5f641c31-b054-5975-a44c-7681a9d818a0", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9aa7190d-c6d8-530a-8c7a-c8b6d97fda5b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3ab35b7-43cd-5cb0-b0dc-393c8f9e728b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f7261ad3-b382-5b7b-b88f-a9d072322207", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c7cb3f4-279b-592f-bf92-27f14d6e53d0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--eb5e393c-9543-5a38-95d0-e9a560758718", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aaa8a2d6-1281-533d-912e-f03850320858", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--92ec8eca-24c4-5f5e-989f-52645092bafa", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd5ad984-304e-53a7-b952-27830cc495d7", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--55fb7f39-0850-5489-a387-217047bdaecd", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50644fef-ae4b-561e-a671-25a951c89cf0", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--12ff0d70-a4ff-5cca-8e80-8bafb253aec7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--94e07f46-59fa-5456-8a3e-c9d6db6b49c5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--96505ef7-15df-5d7a-b0a8-3a8f2592887e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa3f347b-74f2-586a-9bc2-7157fcfdadbc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--840f58bb-5924-5061-80d5-ea81e1a4bb92", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3d408d15-fc77-5c42-9bcb-76e927940e91", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a8ea7be1-8d57-5cce-a401-83049a0ee507", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3fb4651-fea6-5a9d-8ca0-0374c3e43c3e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--46998941-e9ee-5102-94f2-dca93a4557a9", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2b85a5e-14eb-5b9c-a985-6706165fc14f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9179f07b-247c-58fd-84b5-586d8dc96ef2", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b656d76-8349-5078-bfde-be09cb8b558a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0f81b6c1-12f5-554d-b4e9-415d724b38f4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--181305ae-4c09-5ef9-b183-4a28524e5e51", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9c921045-4123-532b-8b79-6dc129637d30", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2ec0ca98-0b9e-598a-8f0b-6e7ec7f4c771", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f094e140-6365-52fe-a428-e2d3fedc18a2", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--33f2fefc-7029-5505-a12b-93b78496c0ba", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9f78fe24-e591-5d8c-8f78-2cd5414da78f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7476aad5-cbfe-5ee8-ac77-56a8c25b447b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f0605778-593c-5c24-a0e4-4e54c0960bc1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--280f2772-8944-5256-ab3b-42b8d49daf27", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--490dce38-65ac-5f40-8929-7f3695646f50", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c45a8d7f-2797-5484-a6f7-571743cba876", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a2e021de-573d-573c-af8d-2eea4fc3e75e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--244d1811-a8b4-597f-8b1a-41b20352eef7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a01c8de3-ac3e-5000-bae6-cbf1e2078a34", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bed1b5a9-d19b-5b63-a719-a26c9e235f24", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d4746b71-62f4-5283-a3e8-3e0a3025bdd5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf5556fa-e3df-59e0-aaca-fa0e6ce3b856", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--52f97fd2-c7f3-5974-8cbd-ab8cfff8e8ab", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df277692-e029-5a12-a3cb-933e7ff7961e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--21c6a678-5ea8-5139-85eb-7c80818e611c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b16eb712-c7f7-5f03-8fac-ba5a79f5e792", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--16cf74e7-7256-5dfb-a5aa-d66ee1f8db2c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4b605a07-9505-5085-ab6c-801a2287501b", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--277fbd1e-0e02-5425-8faf-c2e9e3ed693c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e1aac6c1-ab87-5c35-8092-08736b43a99d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8c2fa2cb-2a91-5008-bf67-fee6882df253", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--813d1d64-c30c-5f1c-9ab1-1331d0da3bcf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fa65a587-6674-5a6e-a8bf-952aab715a13", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--deebe8d9-3b15-5db5-9371-47cfb602dda3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7dcb6ff3-df78-5612-87b9-1a02a9583038", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e5f7d8d3-821d-5a25-8f0d-2935eb53902a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--93f2ef5d-adc1-5652-8394-2231b7fce79f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ed36d86-b5f9-540a-aa10-ca7e392f493a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3d0e8ea7-31e0-5cda-ab35-9fdc668a7e12", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4875073d-f49b-5174-bb3f-28a19bf9a4d1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--aad95097-8a51-58ce-bfc7-561e2545a974", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5815b7a7-6b73-591f-9a69-04a3e4ecf24f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--52dd2ef8-6664-5864-9976-9271cec9ab16", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9be2d751-259a-5cf8-8c1f-2e02f627958f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--07ac9fd8-c25b-58f1-9d8d-b63178640ba7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3ea2b8e4-32fe-5995-9504-50dcb4083c7d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a58bf6ed-151b-52aa-bb3e-c847e356f28e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02fdbdd8-cac3-5a04-a622-752ffb005d5c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--29f43c4d-5fc4-578c-a76f-0bd56c741d30", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6869492a-396d-5dfa-8cf0-aacd66dd9695", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--75138b27-51a0-5721-8d4d-7d8118ed2589", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9bb604f-2803-5ac8-9d50-11fb03d27586", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b352b5f2-a30f-5585-b0f8-fa337d693a7f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9cf66654-e17e-5fe4-a72e-cd293e597e77", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b802e3a4-ed92-5296-b26c-9c0d5ebc7869", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--369c89a4-344d-53d7-b20d-4da539e1bc4d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0f189626-a465-5e17-85a8-893499d35f6d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7843f6dc-dd7e-55fe-ab91-128bddbfb883", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--21875a74-3953-5933-a25d-a62c189a7b92", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a639381c-c190-5274-a54b-15fe79df9028", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a457cc88-b972-5926-bac8-d6e3d1db4ea8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--429df19a-9915-5308-a3f4-2eeb52eaba02", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d5ca03fb-d0bc-5ff4-afd2-dcbfade16ff3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01c32e62-5fa5-5dd2-9bce-bf9455edc0ad", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3d9bf952-f41c-5d19-bb2d-9be6828d2f85", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29e30780-7b2a-5163-b02d-4c4cebf1c896", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4e07f13e-8941-5a4b-99c3-5782f061e120", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ae88420b-d2b4-5614-84d2-b20246c24133", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8430ca8a-f29b-535b-863e-bd0d15a9ad5e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--69d4f6e9-e0da-5def-a21f-a7b4c8669225", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--949a46bd-6b4c-5741-ac48-99060d96bbf0", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aa59beff-b547-5519-931d-65367bba7005", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--93225fa3-0f11-5a45-b880-e6b8e94bd0c5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--47be43bf-1b81-50b2-9073-ec944df14764", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--034be14c-c502-5cdb-be66-ec77a89a3ad3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f147423-481c-5391-bd29-69e6b77dd02c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--aff70c12-5568-55e3-9a47-9e61188736bd", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4e04bcc5-9b34-548a-a3e8-9e28c7974640", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5b49cc7b-8c28-5c58-a9e4-eacf4db01238", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f7c9dbb-0755-5564-9ee6-a162f2f7a500", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--86ec5bb7-bda5-5c8b-8449-4394cacfb198", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--280517b0-30a5-50a2-a781-5816b95304b2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--24c0ec3b-4f69-5dca-a520-98247fcad567", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ae1c3da-02b0-57d6-89e4-efe77841a8ad", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5b0b2e83-d654-5e9c-a8c0-2ba47e442773", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60e06c41-c926-5d89-bb62-a8a9a8e4b633", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--13e52c13-ba2e-503f-b27d-017908de1ab7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--17d38ee2-3c30-5d64-a260-15f230245344", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8e75c5eb-c234-5793-b37c-d063b6415a96", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--edbe4deb-ce2c-5e69-a57b-b0da9dcdb715", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4c5cee1c-0add-5a43-869c-9c8722c1b74d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2ac5f3e-1ecf-5e94-8dbc-5343e85ae39c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--81844542-9035-5b52-9a5f-0c6be466b067", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ae87ce22-1c48-57ae-9e05-1bcdd0b81067", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e8fd7d75-9156-5c54-8f0a-6439b583aaa5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d234a8b6-5c2b-5e5a-a8ef-ed6f491c173e", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8d68c0b2-cf31-5f4d-bea4-e00888a310ac", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--30a00b5d-38e9-5d1b-99a9-2a2c7a43064a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2829db85-28fa-5d13-b9f4-1afb85637a14", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4c5d01be-e419-505d-8a67-b6cbffe2e93a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--bd438c18-912d-5a24-b081-5a83afe07585", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0310f06f-0bf6-52ac-8672-32e2dc951472", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9dd28096-b970-5571-b0bf-96a6d78ab668", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87700d98-b974-598f-b16e-182646b3db76", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c1a66ddf-6f8a-54ee-a20d-83c2bfeaad57", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--175794d5-b501-5084-bad0-707766ef8f2b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--eea8fd38-d52e-59f3-8e54-bb82526eb275", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a8a03662-a78b-500b-8282-b155c6f64f61", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4fb61cf8-23e9-530b-884a-9b5796b1045e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bc98bad-d7e8-5467-bc56-1f085adbe17b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8ffb8def-e203-532e-a2e3-916a13ad2640", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1fd292e1-1c0b-59d2-be72-d329e53be0dd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f2307656-7da8-5aef-8075-4604b48f0b15", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e7d4187a-579b-58b2-9731-466f1863faa1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fd13bc71-265a-5788-9436-09d91167eae0", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7fe7fc6-1fb6-57c7-8aa8-2cce6119dac4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--96741a74-b648-5709-8aeb-54b77bbd7a8f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b4e356f9-35e7-5851-8508-9c156878da3f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--70403fd4-1d66-5ad0-a69a-d86b9e49581a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--112294fd-153f-5029-b655-49d733746ac9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--62b7dffd-489a-54bf-923b-d71af6653495", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--225e7bc1-33e9-5491-a53a-24da58599224", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d17f1380-ca54-51be-932f-c270f899d95e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--06f0a8e3-69bd-585b-bd6a-a754c6919ecb", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c72528a6-0bf4-58d4-80f9-1207e30bf7f0", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aee3ff17-4480-5a2c-b798-35cc7d908697", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d5d059b9-b976-5e0e-ad69-8a9a11a50d4e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b49e461-46ec-57f8-bb9a-d910a6a2a4b4", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--13f429b5-8cd4-5afa-ae84-96b582761ff9", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f035e529-cea1-5e7a-ac98-e904ef808d45", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--14e94cda-2c7f-5eff-849a-3233ca834591", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7714eae6-b1bc-53bf-a104-43d93917b7f2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a7ce87c0-34a6-5b14-8fe3-96f9fbe361a4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be857414-5d6a-528b-ae23-e61c5dda73a3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--868679c3-b2f6-5e76-939c-6e4bdc4da9dc", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35a3b8b6-d42c-5080-8765-c87334c5c46a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3e245c84-37d8-5101-91e8-ace71339b683", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--90db2a70-e8c3-5b39-b0cc-dfee2f766ca1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a3de7bd6-fe03-5ea1-8ca9-db608594b8d7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7413c414-7d12-56b9-b8f6-c457fcee392b", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ab2c9806-3f32-575e-a7f4-f9d4a76d3acb", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b8bab70f-4b5d-5939-aacb-f25d9243a29f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2ecd2702-a304-5923-b5fc-2b99c6d26f90", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0e38a3d6-f113-56f0-adb2-bdf44161cafb", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b89aa87a-e551-5473-8d12-d44242508342", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aeefc23f-1ebe-531f-ad00-dbd4cdc14f8c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d7c1df8c-cee7-5444-b446-833084af91d8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2fdc6f8-406f-5740-b0ec-486beb70effd", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--84000c45-aef6-557b-9276-ecbe3b07a6dc", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b442661a-b5a2-54d6-88af-3f5a46d69559", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--919a6996-96d8-565c-8332-dc91bc83c821", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f2fe7619-775e-593c-ba07-f5af83affedf", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b30ce7c0-75c3-55dc-b6a3-9b2f968bcca2", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d69e135-93b7-51eb-8712-41477f545e30", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2ef10a92-6aed-5232-a9f6-9e72c48cefd3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c117bc7-bd73-5ffb-ae48-0ade5a5aafe9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d4988b2d-1b67-559b-a9f3-f632dce1d205", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--511127ec-87a0-50aa-9675-f3b60affd71a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6e74160d-09f1-5864-a014-b2bb82a0839c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--90667b85-70ab-56e0-b7bd-09386b089225", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--62fc0d0e-f1a4-5e7e-bad4-46bfbb631d4f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70af1685-08c6-5cea-bb2a-0522a1b57c33", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--cf1dc887-1669-55ab-82fd-80e461e126ec", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bdc9ae1d-c33b-585e-a836-5ef3afcd1ab7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--cc37a1c7-1e16-58e8-b0db-feca148b44c5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0aa814c6-55ba-5a28-b5cc-8a17bf756006", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--93bd0593-733e-50d2-a3a9-d77a66be9818", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e686919-8c2c-59d5-b57d-ad9e75a897e2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5759ac63-74b0-517f-a649-02fe1b627123", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa56c999-7e73-5753-a1d3-da10d317b742", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f4172421-03f0-5c2a-806e-a2120969a714", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e61f10b-019a-593f-baa2-a9cfba8010a7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8cb67b17-4447-56fc-9a8b-2f7148fcbb3e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ce6153f-ae58-5d67-827c-e55e6a7ba923", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f0ab3196-8fb7-5557-b195-1d2025aa3d24", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e6193594-acfa-5050-8e9b-d7494ccc9659", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--aa96f2ab-6deb-5184-805b-31c9063630df", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3e992ce-5250-51ec-8bed-8c801e0cd08a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--35f31504-8166-5407-b511-ad485891d5b6", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7f56c5fa-337d-5172-b35e-71a4a910dc57", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--04caf740-451d-5ea5-8c2d-fd65a5dc46b3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--de9e1658-f30b-5c6a-a13c-1dc5121ea0e3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5a775530-da09-5d63-bfec-3f3a18be1310", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7274270f-fcb4-5b1e-9ce8-b884953a225a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5d8397d2-70e2-5eb6-9af2-c4e18cb4eb4e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--873ea559-8d61-5fad-bd0f-85bbcf8559ce", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--741332cc-9dc3-5f36-8317-4df49b9eca56", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7f52a6b-6629-5210-ae6c-e35ab1d1ec19", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b1f6c7a0-9b92-5355-a4c1-0ee16ec1a2af", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2adc066a-8a49-5d2c-9d2b-3012d16184f3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c89241fc-c230-58b1-8349-e8f6668fe2c3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39a54ad0-9b75-5aab-9b81-27c6b6e4b15c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2f269832-8553-596d-bd6a-cf1a2d020813", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--babaebf3-ebaf-5500-8a08-b49ed61f4f93", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4d0f7bca-fdc8-5b99-b488-4ddd570b9cee", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8bb26c3b-8a9a-5176-a2e3-9c9ebc55e5a8", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d9530068-6c30-5bdd-a26c-48c6b0aa151c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a25154e2-97ba-5be0-b1c9-f43c39f6419c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1df0d257-446c-5d91-9143-3249173e2dcd", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b4310d81-58a2-5822-bfee-da5a4bfd2a0a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--14c0ff99-0741-5df5-bd09-17d829245f6c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bafd154e-5ec7-57f7-abd1-274bee872f65", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--efa1ba88-9007-5599-b803-67a8f716f2fe", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87987e92-3244-5d19-8999-d49ff325da61", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--957ef285-db0c-551b-8332-0e7fc80dcec8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c041f7e-ce46-515c-9a6e-e5780772a53f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1cc11055-f79c-5034-9178-58fdabcca73e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--539bde5a-d6a8-5dee-af68-f48794905220", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8af30686-59b2-5049-87cf-3b89cdc31a6c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3fd1986f-9092-5b65-b890-6573f1b62662", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8c3c7bdf-4f1e-5d9a-aee8-a268fb59088c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f1c61b68-0ad6-5818-8127-ff347e0eac92", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c2d01fe1-a093-500b-8344-e99b01952ba8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1421aef3-f545-58d7-81a9-72940fd4581f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--46098238-fb08-5a2f-b19d-1c04736bafd9", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c343d73e-45fa-587c-90c4-dd0265c06ce6", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--00bcc7ef-66e8-5913-b6f4-4368bf4a570c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7b08b58c-2139-5398-901a-4909c210a812", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--410ff6fd-3c9d-5f5c-980b-dd8ced2949c3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62dc25b0-5092-5de9-8194-cdac7c802e3f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5619a82b-9828-5a25-b349-1d8287302c43", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--22de6a35-f5b1-5a9f-8781-8147f05945a2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6313e7e9-7e7a-53b0-971a-3f283094bd68", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--adf60479-3c33-5161-b159-54fe34ed1af9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--117236a2-bf04-5295-b910-4e8d1f085ff0", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce4bb869-c552-5dcd-a903-053acc5d3ece", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e06bbdd5-0d1c-5c3b-963f-147c759254e1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87328293-6172-5120-b83a-7514926c0939", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--03726c36-6879-59d6-828a-2d0bf0716ee1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--92a59e69-009e-5035-9b2e-34af377b2589", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4a3e77b6-55ac-5bd7-868a-cbb6e7336529", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f06c61fa-38b6-5108-92c5-8ff82b1685b9", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7c0f23bc-2e3c-5762-a444-6aa89b9c1299", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6b20509f-fa85-5500-963b-9a0dc70ef6c1", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8e1ac5f3-ad37-53cb-b106-32caf78eb59f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a644d9f1-b2c6-520f-a031-f20ca2be4f87", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8fc7049d-16c6-5d85-89e0-8ef633728665", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b81ce64a-0a05-5d4a-95a5-d1e392581f8e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ac8653df-82a5-5df4-99e7-0c68e3cbb67e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36f9ec8c-d1f6-56e0-a611-02ece10fdec3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1f35772c-19b6-563d-a714-4596e6505cf7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--170463c9-0e88-5f72-97c8-11327da4e193", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3c072885-5880-542d-a6e2-623d23c42d21", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a7e68d0e-8072-5b38-bae6-a4e956dadbdc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--cb51fb7e-0054-5fb7-bce6-b34f3827522f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76fb75f8-2a7b-5dcf-959e-1dbdab467bd2", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9a475a17-eb08-55cc-9cb9-01063d37cea1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e0f25126-5bac-5495-b171-4587a6b47796", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--56cc3ff7-f9ad-5ed2-b287-df82210fb24b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--afa46c72-6779-586e-ad36-2ae327b85096", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--81695c83-2f8b-5ea5-9fd2-a30d1d86bf65", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c57a298f-28cc-55ff-aded-fe92ca3b7a74", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--615022e1-e0c4-5c08-ba19-93cfadd4fed8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60f71a2a-55c1-5305-8969-dcb87db7bc2d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9314fc8c-5ddd-5d14-8b22-59c222e1e3b3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5115c5f9-d391-50d8-98cb-6b6b6fb5eb8f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b41e0316-0a12-59cc-9312-a252d0a5a1b2", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--334ebed0-fe40-5895-9631-a5f44c4c9d99", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--98988520-ebe1-5aa2-8af7-6b87f99bfb8c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fe2fc22f-b902-5d91-a585-447da35fb15c", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f31428d9-b6c1-5ed7-908f-266c1d95dd7b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60028dbf-0623-53ff-9105-980fd47adcb5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c48ff11a-8dcd-5ec3-b9b1-f5c893d2d41e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f47e679d-43c2-54aa-801e-499e973c4380", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b600e8ee-7b04-589a-bdd9-39d6c7c6afbf", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8094d91d-86b5-5e41-8559-3d369b96c8a1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--214a1816-1124-5a4d-8be1-4e0cd6cfdbb4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--37bb0c7b-e858-5338-bac0-b42934b41499", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--b5e26bc5-4342-51be-b270-1cbf4973c47a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b7ba4259-5401-574b-9beb-715c2aa9e891", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3e9e4b57-5b90-5e3d-8eaa-2c974be7866f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ecdf256a-85ac-5fb2-994a-d7f448d5cdbb", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--15f69e82-2ca3-5dfb-91b5-5893c10fd85f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58c2b9b3-071d-518b-97ef-b70b0d127ba2", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c6b3c44d-f8c2-5d24-b0ae-6582b5d2f4a3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--17a21f84-281d-5d75-bd86-c29b033d7d24", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--10956a59-9c33-5cee-81db-fc57566dc137", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--37c1463a-a4cf-5c23-a177-69c6ae94c61a", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--71a4731c-9480-5bb8-9985-fe5da3d498ff", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e4f6ac3f-edb6-589e-b259-a2683e684e0f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--dfe56b9d-c697-524c-ada2-bfe7a75368e5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6c0cbc8a-fb61-5f90-97ef-351e30f3f041", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0d77ef8d-9653-5bfb-a461-b9aa7ffe1d28", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--35090d51-983a-5dbf-85ae-8f79410296fe", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2b589c17-ca1e-59f7-a9ab-b6c1c18a3b49", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb40af43-501b-599d-936f-976b40dfacb8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--36b874d5-e7f2-531a-bec5-d1376313683c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6733dde-bf3c-57b9-851f-31e48d55ca94", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--90518617-de20-58f7-bfb4-1cac6f5e6e67", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d56c365f-f579-5716-b033-6fac62ef7782", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7121aaed-514f-5467-9ffa-ce2a1af997d5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf57c3a9-486b-5e65-8099-077957b3c774", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--0303f400-7296-573b-a5ee-3c54595586a9", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--447f7a89-b395-5a57-aae6-262c1ef81f22", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9c0f4c1f-e58e-53e7-a8eb-24bdbe0949fa", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--424f3381-51b0-5f99-b3cf-88ffa2352140", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--10759b97-cf0a-5e29-a4cf-1d101ca15f5e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f1064ae-8ea3-572f-becf-9a78987fc0f3", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--eda07e36-93d3-58b0-955d-28599996ba66", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c6fa3ed7-8dc2-5343-9664-4c45e9081a0d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4db1bab8-3f3e-50c3-b2bb-c96033fb4711", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b78f654c-5815-5f8e-a3b7-a089d3d85a3d", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8392a57a-66f7-5d1a-a958-d4cdc177d47c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4cdd9f96-555c-5309-a721-5db2a044f314", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--84a4ff9c-810b-533c-9afc-0d003d871ac8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6b07ef79-8d83-5c95-8d19-335240a90ec5", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--41ed7ab9-d490-5f23-8b8a-0a781504bf9b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad86d91b-6bf5-5dd7-9098-4f402128dbe4", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3ab7871b-d27f-5acd-8e9b-a776a78112e7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d7bd6d4-020a-58ca-a6da-b78d299d983c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2d6c0562-dc17-507c-9708-d181ef76581d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d0a5ef89-9391-5d13-bd66-17297551811e", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--64f0cd80-1ba5-5e89-a69a-4fd767d458d1", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--512f0bc7-85c1-58d8-b616-ab4041cb079f", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--9778709b-b0c9-59f7-a208-2fc820cf8a3e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a39c81c-b394-552d-8ca2-4facc2a6b785", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f281aebd-3d76-5686-b68d-ea01552c4769", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--85f69e8e-a8a4-5391-9a1d-17d504d39844", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a3dc4457-dc84-57b2-8769-407b8e1921e3", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2cf064f-1fd4-5c95-87c8-e86d1eae0ba1", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--1fcd795e-c9c3-5e21-aee7-4ae24ce63210", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66299856-f2b2-55c4-a513-fcfe42019df7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--46123374-4e41-55c8-8f12-e8ca399cdd7e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af568921-05cd-599b-a8fd-771f9b1e0e36", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2fccdebe-4ec0-5303-9a33-6751de73fc9b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--17a5268f-e7ba-53d0-9283-ff0aa53d3113", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a914a69b-b2b6-5ea1-83ce-89ae94b035c7", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--20aaf1e5-23e7-583a-a663-593ee74c7849", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--762a0a46-ff1a-5e2d-a254-50488b49170f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66c484c9-cf50-59d5-9eb4-219c0d6e4398", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--83176ef7-8b68-5f1c-9c79-1202bc0c503c", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fe09a5e1-7619-50a5-a808-d361cd313a9f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--11c0a215-aad6-5011-9412-69160b3bbd3d", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e98f9809-fefa-5452-8d7f-a4f252827738", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a2a7ec44-8815-552a-9846-47d2208a05b4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29949e40-e1dd-5fd1-8bf4-3c9b7e744907", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--accdbf02-24bb-5cf2-80f9-e139c6acf07e", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1aa6e8d-25d3-554a-9eb0-f74de83f0b80", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--896a72b7-9773-58ca-a04d-fff01110fcf4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39a94a04-2f3b-56e2-ae82-6b0de5d28e82", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c84b432e-ac23-5cbb-a134-ff1c6c300ca4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--662df752-e4ad-5dac-8754-435f86e0fe24", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--045d07e9-c17a-5104-b51a-730788e6bfe4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--014aa7f2-660f-55d6-be83-eb73642f3298", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--402c630b-d528-58d6-a60b-c741a54af940", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf94be68-81e5-5615-93b0-3690bc969cef", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--8425539e-d8c8-5993-bb3d-fc9d3fc2b6ac", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b39013e9-03ac-5ecb-b89e-f21aa30c2bbb", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--7b078a1c-aab7-5edb-960c-c3616b8e6e32", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--851bd8b7-c0b1-5cce-b041-1a9e1962c6d8", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--dabf95a3-adbf-5405-ad71-457755157295", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1632f58b-45f3-5b93-aaec-510c22cec75c", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--d7771d8c-ee4d-55a3-9c72-a849c9f72296", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e215edee-fe0a-561a-99d3-d45c0a260fa3", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--e584b29b-2671-5f79-a0cb-725a5fad3ffa", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0af4af0-e847-5cfc-a4d0-e7d6d5350ff4", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--a61e071b-f48b-563c-9466-25bddc3e9068", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8abbca8-563b-5e62-b163-39e3fe0e406f", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--3804de28-ab70-5bae-8446-68f07d0af3ee", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--48af4c86-92b0-5c2f-a7c8-ee22dec24dea", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f1d7a6e1-4794-5b70-aaa8-0850b6d44bf2", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c5bfab53-59a1-5138-a79b-674d01d0aeea", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--fffc6e9a-f6cc-53b5-ae51-39dfa60f7aa8", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--162782d2-c534-5538-8d20-d4a97ec89245", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--25fbad9a-e284-52e5-9a76-1aaef782b84a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--11aba8e8-1e90-565e-a4fc-e919ac38b712", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f4df5517-76d3-55ee-9689-5f6080788a06", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0cf9bf62-35ed-5bbd-a088-694338bc6eb7", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6feaab7b-e51d-5e0a-8bdf-a7db19bf6175", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39b4f279-c00e-50c5-ab9a-13abdfde5e38", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--4c40c5b0-e44e-5868-9a6d-f4d24c21ed3b", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a03c96b-2819-53ee-a7b7-61383fc635e1", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--221208df-ef02-5dff-b382-a8736033c5d5", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--093064d4-3ac0-5581-9ab3-dd927feea3b6", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--f54890ac-a6a8-5546-a3ba-63f15e7b597f", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b21cecb-3b5e-5e54-b9e2-26580b4bb7fd", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--c7f3b59b-48ed-5918-ba29-1d0f32ceb6e4", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7a2efe1-3a00-5d83-81b4-cb583da30623", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--209b4129-1303-5461-85ad-84a46a84a31a", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--373def2f-79b9-5d17-9165-c56b837ec561", "created": "2026-10-18T22:33:48.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--2e692e30-c938-52d7-9538-9b8e4d40f6be", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2f1ba184-90b2-50c6-82cb-482eb0899ddc", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--6bdb2de5-9ae5-5e2a-b15d-62bd65e66591", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c6f8f1d-9644-5a73-b513-41ad131ab252", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--5f648485-bbc9-5256-bd48-2212fa9aab30", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--753bb46e-2f79-5f7c-84f3-996a730b6a95", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--05411c1d-ad4a-5d2c-94f9-7d903698fc58", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7e750643-7f59-55e4-ba28-ce138888e3b0", "created": "2026-10-18T00:00:00.000Z", "modified": "2026-10-18T22:33:48.000Z", "relationship_type": "indicates", "source_ref": "indicator--ae0f3355-4c90-512c-8cc3-7128761d4367", "target_ref": "malware--75526ba0-abba-56bc-af06-770a39688ab3" } ] }