{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 13, "direct_entities": 28, "direct_relationships": 27, "invalid_iocs": 0, "iocs": 13, "mentioned": 2, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 1 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 30, "excluded_graph_objects": 416, "graph_complete": true, "graph_objects": 28, "graph_relationships": 27, "mitre_context_complete": true, "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "status_as_of": "2026-10-10T08:47:58+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:04.313Z", "updated_at": "2026-09-25T21:38:04.763Z" }, "description_available": false, "entity_type": "StixFile", "id": "29980e1a-cdbb-489e-a4c0-00b283494099", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--c5117e0f-cf13-5536-8e1f-3f2c879d53f7", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.414Z", "created_at": "2026-09-25T21:38:09.186Z", "modified": "2026-09-25T21:38:45.861Z", "updated_at": "2026-09-25T21:38:45.861Z" }, "description_available": false, "entity_type": "Indicator", "id": "5bd24888-69ab-42df-a3da-d26291a4e167", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--6597ad9a-c84b-5a9e-bf03-720f6a46c8d6", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.417Z", "created_at": "2026-09-25T21:38:09.314Z", "modified": "2026-09-25T21:39:05.202Z", "updated_at": "2026-09-25T21:39:05.202Z" }, "description_available": false, "entity_type": "Indicator", "id": "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--c183bfd5-cf37-5a9d-b5e8-a9c856a4ae3b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.420Z", "created_at": "2026-09-25T21:38:10.462Z", "modified": "2026-09-25T21:39:18.935Z", "updated_at": "2026-09-25T21:39:18.935Z" }, "description_available": false, "entity_type": "Indicator", "id": "652afbee-1677-4b3c-895a-0c40b1041b97", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--2162e7c6-973b-5e24-9ecc-008054207ebf", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.404Z", "created_at": "2026-09-25T21:38:07.856Z", "modified": "2026-09-25T21:38:21.665Z", "updated_at": "2026-09-25T21:38:21.665Z" }, "description_available": false, "entity_type": "Indicator", "id": "6712c8cd-dd32-4e92-b519-460ef2eb4772", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--5005a443-7444-5a5a-b426-9548e9f0fd40", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:01.281Z", "updated_at": "2026-09-25T21:38:01.598Z" }, "description_available": false, "entity_type": "StixFile", "id": "70d59e96-7ebd-41c7-924f-c7288a4e228d", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--2a23d604-af85-5efc-a15e-036f8496a47c", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:03.181Z", "updated_at": "2026-09-25T21:38:03.539Z" }, "description_available": false, "entity_type": "StixFile", "id": "70e96f2d-1af7-4f90-bae3-c3441fd898e8", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--4434046a-c0b4-5a5c-a7d9-95c1b2a66ef6", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.411Z", "created_at": "2026-09-25T21:38:08.300Z", "modified": "2026-09-25T21:38:38.804Z", "updated_at": "2026-09-25T21:38:38.804Z" }, "description_available": false, "entity_type": "Indicator", "id": "79b44b8d-83ed-4b96-9a01-3345f9b06584", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--0e8120dc-0675-57de-8eb1-8887ff2b0ee6", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.429Z", "created_at": "2026-09-25T21:38:13.718Z", "modified": "2026-09-25T21:39:38.440Z", "updated_at": "2026-09-25T21:39:38.440Z" }, "description_available": false, "entity_type": "Indicator", "id": "7e404259-64ee-4a77-93d4-e071a273d411", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--c619bfba-399f-598e-929a-800587a51b44", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:02.270Z", "updated_at": "2026-09-25T21:38:02.627Z" }, "description_available": false, "entity_type": "StixFile", "id": "88c6349f-3d65-4b52-ad23-c9912f1cf3c0", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--b67d91fc-a369-567c-bb0e-b575e901a10e", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:01.599Z", "updated_at": "2026-09-25T21:38:01.907Z" }, "description_available": false, "entity_type": "StixFile", "id": "929cbdcd-420d-41b8-a7c9-88e032a48b78", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--1753f8c3-7fc4-5676-97f8-9d438aa41884", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.393Z", "created_at": "2026-09-25T21:38:06.624Z", "modified": "2026-09-25T21:38:08.905Z", "updated_at": "2026-09-25T21:38:08.905Z" }, "description_available": false, "entity_type": "Indicator", "id": "92e847d5-0a29-4491-9370-8731d8636062", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--4c6db79b-6401-5800-aeaa-f41e4f43310a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.435Z", "created_at": "2026-09-25T21:38:20.448Z", "modified": "2026-09-25T21:39:42.707Z", "updated_at": "2026-09-25T21:39:42.707Z" }, "description_available": false, "entity_type": "Indicator", "id": "96d2a89c-5630-49fd-86e3-db44939258d6", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--09fc1d54-9b83-5f29-9b3c-01be3f0270b3", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.399Z", "created_at": "2026-09-25T21:38:07.026Z", "modified": "2026-09-25T21:38:12.933Z", "updated_at": "2026-09-25T21:38:12.933Z" }, "description_available": false, "entity_type": "Indicator", "id": "ab41be1d-f347-49e0-a655-66e811ceaed5", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--5bfd547b-5154-5ad3-a34a-ed16efb441c4", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:06.408Z", "updated_at": "2026-09-25T21:38:06.832Z" }, "description_available": false, "entity_type": "StixFile", "id": "acac639e-5844-4a06-9041-af96ac8ca09b", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--2917b9fc-f1cf-5449-987a-d8a4fd65926a", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.407Z", "created_at": "2026-09-25T21:38:08.045Z", "modified": "2026-09-25T21:38:29.579Z", "updated_at": "2026-09-25T21:38:29.579Z" }, "description_available": false, "entity_type": "Indicator", "id": "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--73ad8801-9420-508a-b443-ed785c920526", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:37:58.645Z", "updated_at": "2026-09-25T21:38:00.313Z" }, "description_available": false, "entity_type": "StixFile", "id": "b1128a49-7c56-45e3-9e65-21fb6419f111", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--81edc3da-fe83-5c9c-992a-b9b3b27edcf8", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.423Z", "created_at": "2026-09-25T21:38:12.659Z", "modified": "2026-09-25T21:39:32.214Z", "updated_at": "2026-09-25T21:39:32.214Z" }, "description_available": false, "entity_type": "Indicator", "id": "bbe24811-ecf3-45ac-9964-31b4424f29e8", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--f0be7897-f706-5164-a40d-f34629af767d", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:04.164Z", "updated_at": "2026-09-25T21:38:04.625Z" }, "description_available": false, "entity_type": "StixFile", "id": "c9545f55-3e15-4135-bb4d-9d63a13b0689", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--e69ba7ef-c501-51b8-8bc8-06adb05de2ba", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:01.593Z", "updated_at": "2026-09-25T21:38:01.905Z" }, "description_available": false, "entity_type": "StixFile", "id": "cd886a6b-fb79-4030-8456-c017fd1c2aea", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--603828a7-64f2-5a4f-be8d-fab59f80692a", "type": "StixFile" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-07-29T00:00:00.000Z", "created_at": "2026-08-08T19:35:17.757Z", "modified": "2026-09-25T21:37:58.022Z", "updated_at": "2026-09-25T21:37:58.022Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "cfa03587-5e30-4f80-aeac-e27ff2c57738", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-20316", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-20316", "id": "3757468f-9077-4d1e-8160-2ec52ca58728", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20316" }, { "external_id": null, "id": "b80856dd-fb6f-41d8-9f56-e1215f79f915", "source_name": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "vulnerability--1153f83f-1970-5c12-b5bb-da52631001f7", "type": "Vulnerability" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.325Z", "created_at": "2026-09-25T21:37:54.871Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-25T21:37:55.435Z", "updated_at": "2026-09-25T21:37:55.435Z" }, "description_available": false, "entity_type": "Malware", "id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "is_inferred": false, "labels": [], "lang": "en", "name": "PEEP", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "malware--2578b9f0-5a49-56cc-8518-34cbcd4a6a50", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.432Z", "created_at": "2026-09-25T21:38:15.926Z", "modified": "2026-09-25T21:39:40.424Z", "updated_at": "2026-09-25T21:39:40.424Z" }, "description_available": false, "entity_type": "Indicator", "id": "d9f921fb-3407-4423-ad45-37c2c5532a50", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--cf971b3b-53dc-5c08-8f3d-ff4e93fc5c93", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:02.640Z", "updated_at": "2026-09-25T21:38:03.198Z" }, "description_available": false, "entity_type": "StixFile", "id": "dc38ddc7-3b6f-436b-8ab1-43833fa13e27", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--f7b1f1f3-c6e9-5467-ae3e-34d57f892605", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:37:59.078Z", "updated_at": "2026-09-25T21:38:00.447Z" }, "description_available": false, "entity_type": "StixFile", "id": "e2fe7d1b-118f-4fc2-a5e1-aef38b79c092", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--d4722874-e9da-5699-9df6-3a5b00bce7a1", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:37:58.878Z", "updated_at": "2026-09-25T21:38:00.445Z" }, "description_available": false, "entity_type": "StixFile", "id": "ead8e5ac-fe92-4b7f-95e6-5993c07ea1a9", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--94e2beed-2d0a-5ba5-af1e-7b2bc17cfe88", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T21:38:04.575Z", "updated_at": "2026-09-25T21:38:04.831Z" }, "description_available": false, "entity_type": "StixFile", "id": "f70100ad-983c-4e75-ac97-4e736fc91cf4", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "file--dab8ff9e-3b3a-5cb1-aa86-98589702729d", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.426Z", "created_at": "2026-09-25T21:38:13.128Z", "modified": "2026-09-25T21:39:34.538Z", "updated_at": "2026-09-25T21:39:34.538Z" }, "description_available": false, "entity_type": "Indicator", "id": "fe16ede5-8e33-4a02-89c4-5f9fbe75054a", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "indicator--13bf415e-28b6-5b21-93c2-48d14125851e", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.365Z", "created_at": "2026-09-25T21:39:52.050Z", "modified": "2026-09-25T21:39:52.226Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:39:52.226Z" }, "description_available": false, "entity_type": "targets", "fromId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "from_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "from_name": "PEEP", "from_type": "Malware", "id": "0238c80f-a2a3-49e3-b3aa-cfed2d007cb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--1a202193-f8f4-51a0-b52d-e084571da2ec", "toId": "cfa03587-5e30-4f80-aeac-e27ff2c57738", "to_id": "cfa03587-5e30-4f80-aeac-e27ff2c57738", "to_name": "CVE-2026-20316", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.534Z", "created_at": "2026-09-25T21:42:33.985Z", "modified": "2026-09-25T21:42:34.239Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:42:34.239Z" }, "description_available": false, "entity_type": "indicates", "fromId": "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "from_id": "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "from_name": null, "from_type": "Indicator", "id": "07a95182-da0b-4c01-9a23-12d9d2cb0e36", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--0568922b-9db6-5614-afd2-3a37bc1c5fc7", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.406Z", "created_at": "2026-09-25T21:40:20.277Z", "modified": "2026-09-25T21:40:21.656Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:21.656Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6712c8cd-dd32-4e92-b519-460ef2eb4772", "from_id": "6712c8cd-dd32-4e92-b519-460ef2eb4772", "from_name": null, "from_type": "Indicator", "id": "0bd894a4-9483-48a9-9eda-5e10a1d82f19", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--da4cd97b-1b67-50f1-8cb7-9a66954f8aea", "toId": "b1128a49-7c56-45e3-9e65-21fb6419f111", "to_id": "b1128a49-7c56-45e3-9e65-21fb6419f111", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.501Z", "created_at": "2026-09-25T21:41:56.795Z", "modified": "2026-09-25T21:41:57.333Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:41:57.333Z" }, "description_available": false, "entity_type": "indicates", "fromId": "79b44b8d-83ed-4b96-9a01-3345f9b06584", "from_id": "79b44b8d-83ed-4b96-9a01-3345f9b06584", "from_name": null, "from_type": "Indicator", "id": "12f83d13-2569-42c4-83dc-fb6a238bb028", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--f5fbcc76-0121-57fe-87f5-b4636147e941", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.569Z", "created_at": "2026-09-25T21:43:16.375Z", "modified": "2026-09-25T21:43:16.851Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:43:16.851Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bbe24811-ecf3-45ac-9964-31b4424f29e8", "from_id": "bbe24811-ecf3-45ac-9964-31b4424f29e8", "from_name": null, "from_type": "Indicator", "id": "16df694a-1ba1-499e-a485-8a51d7787bcc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--3e961c24-22f6-5393-97ef-45130af17323", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.428Z", "created_at": "2026-09-25T21:40:25.122Z", "modified": "2026-09-25T21:40:25.651Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:25.651Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fe16ede5-8e33-4a02-89c4-5f9fbe75054a", "from_id": "fe16ede5-8e33-4a02-89c4-5f9fbe75054a", "from_name": null, "from_type": "Indicator", "id": "1994b873-a8ec-4fb7-bf59-ddc5341fee89", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--c7f5e51d-6f94-5b4b-a016-fc76be590ec7", "toId": "c9545f55-3e15-4135-bb4d-9d63a13b0689", "to_id": "c9545f55-3e15-4135-bb4d-9d63a13b0689", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.485Z", "created_at": "2026-09-25T21:41:36.176Z", "modified": "2026-09-25T21:41:36.518Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:41:36.518Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c", "from_id": "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c", "from_name": null, "from_type": "Indicator", "id": "1d896de8-54e6-402e-88bf-9f1400facd4a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--8b5522b5-2dc3-5e70-aead-987344db5533", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.621Z", "created_at": "2026-09-25T21:44:14.037Z", "modified": "2026-09-25T21:44:15.356Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:44:15.356Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d9f921fb-3407-4423-ad45-37c2c5532a50", "from_id": "d9f921fb-3407-4423-ad45-37c2c5532a50", "from_name": null, "from_type": "Indicator", "id": "313bed2a-096d-47b4-802a-44e1dabdd516", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--33d63afb-884b-5118-bbca-c2aba712303d", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.469Z", "created_at": "2026-09-25T21:41:14.852Z", "modified": "2026-09-25T21:41:16.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:41:16.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6712c8cd-dd32-4e92-b519-460ef2eb4772", "from_id": "6712c8cd-dd32-4e92-b519-460ef2eb4772", "from_name": null, "from_type": "Indicator", "id": "40824cab-861b-40d4-994e-797e9ab1f725", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--83a1e93b-7c4f-5fcf-a821-e5ffc35a21c9", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.416Z", "created_at": "2026-09-25T21:40:22.084Z", "modified": "2026-09-25T21:40:22.593Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:22.593Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5bd24888-69ab-42df-a3da-d26291a4e167", "from_id": "5bd24888-69ab-42df-a3da-d26291a4e167", "from_name": null, "from_type": "Indicator", "id": "41532ce7-1195-40bf-b981-06336847e769", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--42d8a6fd-fe74-564d-970d-b63b663cab83", "toId": "cd886a6b-fb79-4030-8456-c017fd1c2aea", "to_id": "cd886a6b-fb79-4030-8456-c017fd1c2aea", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.452Z", "created_at": "2026-09-25T21:40:48.690Z", "modified": "2026-09-25T21:40:50.103Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:50.103Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ab41be1d-f347-49e0-a655-66e811ceaed5", "from_id": "ab41be1d-f347-49e0-a655-66e811ceaed5", "from_name": null, "from_type": "Indicator", "id": "47e810ba-f9da-439a-8941-1c2590d39540", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--0294dafc-b6e1-5e65-9639-e4e297092919", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.431Z", "created_at": "2026-09-25T21:40:25.504Z", "modified": "2026-09-25T21:40:27.237Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:27.237Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7e404259-64ee-4a77-93d4-e071a273d411", "from_id": "7e404259-64ee-4a77-93d4-e071a273d411", "from_name": null, "from_type": "Indicator", "id": "4a51f096-f7e6-449b-bad5-fb22953c05b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--86d241a6-2ef2-56ac-8da6-f6d5f8d4400e", "toId": "29980e1a-cdbb-489e-a4c0-00b283494099", "to_id": "29980e1a-cdbb-489e-a4c0-00b283494099", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.550Z", "created_at": "2026-09-25T21:42:53.614Z", "modified": "2026-09-25T21:42:54.406Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:42:54.406Z" }, "description_available": false, "entity_type": "indicates", "fromId": "652afbee-1677-4b3c-895a-0c40b1041b97", "from_id": "652afbee-1677-4b3c-895a-0c40b1041b97", "from_name": null, "from_type": "Indicator", "id": "4cc215f4-d3ed-4513-9c85-94ecf2316d63", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--ded6e2a7-2d46-5b15-86ea-b5b0893d0a10", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.517Z", "created_at": "2026-09-25T21:42:16.752Z", "modified": "2026-09-25T21:42:17.040Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:42:17.040Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5bd24888-69ab-42df-a3da-d26291a4e167", "from_id": "5bd24888-69ab-42df-a3da-d26291a4e167", "from_name": null, "from_type": "Indicator", "id": "57403611-2700-4253-9883-59be30cf9145", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--e4ceabe5-ddba-558b-9ab9-9f76f881a442", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.588Z", "created_at": "2026-09-25T21:43:36.552Z", "modified": "2026-09-25T21:43:36.828Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:43:36.828Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fe16ede5-8e33-4a02-89c4-5f9fbe75054a", "from_id": "fe16ede5-8e33-4a02-89c4-5f9fbe75054a", "from_name": null, "from_type": "Indicator", "id": "57e15597-7a96-4b77-9d4b-f27532e7c139", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--b4654982-0f2b-580f-8175-016f5efca798", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.637Z", "created_at": "2026-09-25T21:44:35.212Z", "modified": "2026-09-25T21:44:37.419Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:44:37.419Z" }, "description_available": false, "entity_type": "indicates", "fromId": "96d2a89c-5630-49fd-86e3-db44939258d6", "from_id": "96d2a89c-5630-49fd-86e3-db44939258d6", "from_name": null, "from_type": "Indicator", "id": "6a6e2889-ecd2-4eae-937c-6e79733d1e8c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--23ff6ddb-dcaa-596d-8e03-feb002e4411e", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.409Z", "created_at": "2026-09-25T21:40:21.805Z", "modified": "2026-09-25T21:40:22.124Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:22.124Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c", "from_id": "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c", "from_name": null, "from_type": "Indicator", "id": "6cf3990b-5d0c-44da-b813-9de740c1080e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--dd76eb72-2b47-524e-8c4e-1df872dc970c", "toId": "70d59e96-7ebd-41c7-924f-c7288a4e228d", "to_id": "70d59e96-7ebd-41c7-924f-c7288a4e228d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.434Z", "created_at": "2026-09-25T21:40:25.724Z", "modified": "2026-09-25T21:40:29.127Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:29.127Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d9f921fb-3407-4423-ad45-37c2c5532a50", "from_id": "d9f921fb-3407-4423-ad45-37c2c5532a50", "from_name": null, "from_type": "Indicator", "id": "790e7a21-8a90-45e8-8eee-389342db40bd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--1522d958-f1e1-5d35-bf79-b42d2e68bf33", "toId": "f70100ad-983c-4e75-ac97-4e736fc91cf4", "to_id": "f70100ad-983c-4e75-ac97-4e736fc91cf4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.402Z", "created_at": "2026-09-25T21:40:19.383Z", "modified": "2026-09-25T21:40:19.627Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:19.627Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ab41be1d-f347-49e0-a655-66e811ceaed5", "from_id": "ab41be1d-f347-49e0-a655-66e811ceaed5", "from_name": null, "from_type": "Indicator", "id": "85f6c2b6-d4cf-40cf-ac55-cdb743304797", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--3a3cdc5a-5646-5385-96b8-fcad519adef3", "toId": "ead8e5ac-fe92-4b7f-95e6-5993c07ea1a9", "to_id": "ead8e5ac-fe92-4b7f-95e6-5993c07ea1a9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.425Z", "created_at": "2026-09-25T21:40:24.507Z", "modified": "2026-09-25T21:40:25.058Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:25.058Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bbe24811-ecf3-45ac-9964-31b4424f29e8", "from_id": "bbe24811-ecf3-45ac-9964-31b4424f29e8", "from_name": null, "from_type": "Indicator", "id": "acbc4758-9313-4e1b-a776-55787032de30", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--ae1d562f-92f1-5dda-b773-7983e6f8d367", "toId": "70e96f2d-1af7-4f90-bae3-c3441fd898e8", "to_id": "70e96f2d-1af7-4f90-bae3-c3441fd898e8", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.437Z", "created_at": "2026-09-25T21:40:29.187Z", "modified": "2026-09-25T21:40:30.091Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:30.091Z" }, "description_available": false, "entity_type": "based-on", "fromId": "96d2a89c-5630-49fd-86e3-db44939258d6", "from_id": "96d2a89c-5630-49fd-86e3-db44939258d6", "from_name": null, "from_type": "Indicator", "id": "af3e7ccd-cc95-4cc2-90f0-a33a798fa3a3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--37f22d5b-857e-57ac-9fd5-173933d5515b", "toId": "acac639e-5844-4a06-9041-af96ac8ca09b", "to_id": "acac639e-5844-4a06-9041-af96ac8ca09b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.422Z", "created_at": "2026-09-25T21:40:24.043Z", "modified": "2026-09-25T21:40:24.697Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:24.697Z" }, "description_available": false, "entity_type": "based-on", "fromId": "652afbee-1677-4b3c-895a-0c40b1041b97", "from_id": "652afbee-1677-4b3c-895a-0c40b1041b97", "from_name": null, "from_type": "Indicator", "id": "b5274b85-3df8-4cf2-872c-d437d79d022b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--b2806bf9-6547-5496-a40d-237d5495146a", "toId": "dc38ddc7-3b6f-436b-8ab1-43833fa13e27", "to_id": "dc38ddc7-3b6f-436b-8ab1-43833fa13e27", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.397Z", "created_at": "2026-09-25T21:40:18.624Z", "modified": "2026-09-25T21:40:18.929Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:18.929Z" }, "description_available": false, "entity_type": "based-on", "fromId": "92e847d5-0a29-4491-9370-8731d8636062", "from_id": "92e847d5-0a29-4491-9370-8731d8636062", "from_name": null, "from_type": "Indicator", "id": "bec80842-195a-4ea9-a0d6-30e227e53d1d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--bf978fbc-de03-5ca5-8629-0ec352f7f703", "toId": "e2fe7d1b-118f-4fc2-a5e1-aef38b79c092", "to_id": "e2fe7d1b-118f-4fc2-a5e1-aef38b79c092", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.413Z", "created_at": "2026-09-25T21:40:22.004Z", "modified": "2026-09-25T21:40:22.357Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:22.357Z" }, "description_available": false, "entity_type": "based-on", "fromId": "79b44b8d-83ed-4b96-9a01-3345f9b06584", "from_id": "79b44b8d-83ed-4b96-9a01-3345f9b06584", "from_name": null, "from_type": "Indicator", "id": "e3682df7-e399-49be-8fdd-447eb0d9a774", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--aac85926-42dc-5388-a573-d7e5dd4906f8", "toId": "929cbdcd-420d-41b8-a7c9-88e032a48b78", "to_id": "929cbdcd-420d-41b8-a7c9-88e032a48b78", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.419Z", "created_at": "2026-09-25T21:40:22.653Z", "modified": "2026-09-25T21:40:24.424Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:24.424Z" }, "description_available": false, "entity_type": "based-on", "fromId": "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "from_id": "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "from_name": null, "from_type": "Indicator", "id": "e3992e80-e7b9-4eec-ad89-e9c2b0e80c12", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--bc2418ec-b896-526b-b8be-b8b6a06cea73", "toId": "88c6349f-3d65-4b52-ad23-c9912f1cf3c0", "to_id": "88c6349f-3d65-4b52-ad23-c9912f1cf3c0", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.437Z", "created_at": "2026-09-25T21:40:29.539Z", "modified": "2026-09-25T21:40:30.401Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:40:30.401Z" }, "description_available": false, "entity_type": "indicates", "fromId": "92e847d5-0a29-4491-9370-8731d8636062", "from_id": "92e847d5-0a29-4491-9370-8731d8636062", "from_name": null, "from_type": "Indicator", "id": "f715902f-082b-4b44-8207-ed08e41d9a16", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--1c9060de-3791-5cfe-9451-5a382c2ef32e", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:50:58.602Z", "created_at": "2026-09-25T21:43:56.345Z", "modified": "2026-09-25T21:43:56.725Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T21:43:56.725Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7e404259-64ee-4a77-93d4-e071a273d411", "from_id": "7e404259-64ee-4a77-93d4-e071a273d411", "from_name": null, "from_type": "Indicator", "id": "fc2a3055-3742-4777-8a1a-03a0baa26d37", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "standard_id": "relationship--92f4441e-63d5-5c99-98be-9b6f1db99302", "toId": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "to_name": "PEEP", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a6838dd91ec0c", "description_available": false, "object_id": "92e847d5-0a29-4491-9370-8731d8636062", "object_ids": [ "92e847d5-0a29-4491-9370-8731d8636062", "e2fe7d1b-118f-4fc2-a5e1-aef38b79c092" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "92e847d5-0a29-4491-9370-8731d8636062", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a6838dd91ec0c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e2fe7d1b-118f-4fc2-a5e1-aef38b79c092", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a6838dd91ec0c" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a6838dd91ec0c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729ac2efdc1853fb6", "description_available": false, "object_id": "ab41be1d-f347-49e0-a655-66e811ceaed5", "object_ids": [ "ab41be1d-f347-49e0-a655-66e811ceaed5", "ead8e5ac-fe92-4b7f-95e6-5993c07ea1a9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ab41be1d-f347-49e0-a655-66e811ceaed5", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729ac2efdc1853fb6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ead8e5ac-fe92-4b7f-95e6-5993c07ea1a9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729ac2efdc1853fb6" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729ac2efdc1853fb6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6700e30a3224248085d30f2eb727cea28dec288355fca6753449a26d1c1d1eee", "description_available": false, "object_id": "6712c8cd-dd32-4e92-b519-460ef2eb4772", "object_ids": [ "6712c8cd-dd32-4e92-b519-460ef2eb4772", "b1128a49-7c56-45e3-9e65-21fb6419f111" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6712c8cd-dd32-4e92-b519-460ef2eb4772", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "6700e30a3224248085d30f2eb727cea28dec288355fca6753449a26d1c1d1eee" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b1128a49-7c56-45e3-9e65-21fb6419f111", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6700e30a3224248085d30f2eb727cea28dec288355fca6753449a26d1c1d1eee" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "6700e30a3224248085d30f2eb727cea28dec288355fca6753449a26d1c1d1eee" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3db906af00beb", "description_available": false, "object_id": "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c", "object_ids": [ "70d59e96-7ebd-41c7-924f-c7288a4e228d", "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b0fefbd3-c057-4f74-82bb-fdc8bb75a11c", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3db906af00beb" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "70d59e96-7ebd-41c7-924f-c7288a4e228d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3db906af00beb" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3db906af00beb" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66af2fe34e2987", "description_available": false, "object_id": "79b44b8d-83ed-4b96-9a01-3345f9b06584", "object_ids": [ "79b44b8d-83ed-4b96-9a01-3345f9b06584", "929cbdcd-420d-41b8-a7c9-88e032a48b78" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "79b44b8d-83ed-4b96-9a01-3345f9b06584", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66af2fe34e2987" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "929cbdcd-420d-41b8-a7c9-88e032a48b78", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66af2fe34e2987" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66af2fe34e2987" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f10f5d892a675f", "description_available": false, "object_id": "5bd24888-69ab-42df-a3da-d26291a4e167", "object_ids": [ "5bd24888-69ab-42df-a3da-d26291a4e167", "cd886a6b-fb79-4030-8456-c017fd1c2aea" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5bd24888-69ab-42df-a3da-d26291a4e167", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f10f5d892a675f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "cd886a6b-fb79-4030-8456-c017fd1c2aea", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f10f5d892a675f" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f10f5d892a675f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3afe870bf3870b1", "description_available": false, "object_id": "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "object_ids": [ "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "88c6349f-3d65-4b52-ad23-c9912f1cf3c0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "632ccc93-8184-4bca-b2f2-6c9fed78a8a2", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3afe870bf3870b1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "88c6349f-3d65-4b52-ad23-c9912f1cf3c0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3afe870bf3870b1" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3afe870bf3870b1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb82d34a35ab528", "description_available": false, "object_id": "652afbee-1677-4b3c-895a-0c40b1041b97", "object_ids": [ "652afbee-1677-4b3c-895a-0c40b1041b97", "dc38ddc7-3b6f-436b-8ab1-43833fa13e27" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "652afbee-1677-4b3c-895a-0c40b1041b97", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb82d34a35ab528" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "dc38ddc7-3b6f-436b-8ab1-43833fa13e27", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb82d34a35ab528" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb82d34a35ab528" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e9b5240a590d8", "description_available": false, "object_id": "bbe24811-ecf3-45ac-9964-31b4424f29e8", "object_ids": [ "70e96f2d-1af7-4f90-bae3-c3441fd898e8", "bbe24811-ecf3-45ac-9964-31b4424f29e8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bbe24811-ecf3-45ac-9964-31b4424f29e8", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e9b5240a590d8" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "70e96f2d-1af7-4f90-bae3-c3441fd898e8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e9b5240a590d8" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e9b5240a590d8" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec1005974bf1a81974a1", "description_available": false, "object_id": "fe16ede5-8e33-4a02-89c4-5f9fbe75054a", "object_ids": [ "c9545f55-3e15-4135-bb4d-9d63a13b0689", "fe16ede5-8e33-4a02-89c4-5f9fbe75054a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fe16ede5-8e33-4a02-89c4-5f9fbe75054a", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec1005974bf1a81974a1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c9545f55-3e15-4135-bb4d-9d63a13b0689", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec1005974bf1a81974a1" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec1005974bf1a81974a1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a6d624214e893", "description_available": false, "object_id": "7e404259-64ee-4a77-93d4-e071a273d411", "object_ids": [ "29980e1a-cdbb-489e-a4c0-00b283494099", "7e404259-64ee-4a77-93d4-e071a273d411" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7e404259-64ee-4a77-93d4-e071a273d411", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a6d624214e893" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "29980e1a-cdbb-489e-a4c0-00b283494099", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a6d624214e893" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a6d624214e893" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8eb33a291d66d", "description_available": false, "object_id": "d9f921fb-3407-4423-ad45-37c2c5532a50", "object_ids": [ "d9f921fb-3407-4423-ad45-37c2c5532a50", "f70100ad-983c-4e75-ac97-4e736fc91cf4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d9f921fb-3407-4423-ad45-37c2c5532a50", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8eb33a291d66d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f70100ad-983c-4e75-ac97-4e736fc91cf4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8eb33a291d66d" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8eb33a291d66d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4de677f1d7415", "description_available": false, "object_id": "96d2a89c-5630-49fd-86e3-db44939258d6", "object_ids": [ "96d2a89c-5630-49fd-86e3-db44939258d6", "acac639e-5844-4a06-9041-af96ac8ca09b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "96d2a89c-5630-49fd-86e3-db44939258d6", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4de677f1d7415" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "acac639e-5844-4a06-9041-af96ac8ca09b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4de677f1d7415" } ], "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension", "type": "sha256", "valid_from": "2026-09-07T12:42:38.000Z", "valid_until": "2027-06-24T23:52:22.557Z", "validity_status": "active", "value": "f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4de677f1d7415" } ], "mentioned": [ { "confidence": 50, "evidence_id": "d5b9b97f-472d-40e0-b1b4-f8bb7aa5232f", "name": "PEEP", "role": "mentionné", "type": "Malware" }, { "confidence": 80, "evidence_id": "cfa03587-5e30-4f80-aeac-e27ff2c57738", "name": "CVE-2026-20316", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-07T12:42:37.294Z", "created_at": "2026-09-25T21:49:59.295Z", "modified": "2026-09-25T21:50:05.726Z", "published": "2026-09-07T12:42:37.294Z", "updated_at": "2026-09-25T21:50:05.726Z" }, "description_available": true, "id": "a6a9db68-3b87-4a75-b11c-b841f191138b", "is_inferred": false, "labels": [ "browser extension", "chrome rat", "native messaging", "peep", "post-exploitation", "session hijacking" ], "lang": "en", "name": "PEEP: A Browser RAT Posing as a Chrome Extension", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-07T12:42:37.294Z", "references": [ { "external_id": null, "id": "a9c09306-e3a8-4b0c-8c11-c5c20319fec9", "source_name": "alien-vault", "url": "https://socradar.io/blog/peep-browser-rat-chrome-extension" }, { "external_id": "6a9eb13dfccfac432c46d96e", "id": "4cd88558-aa20-4179-abe1-6bd81f01b695", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6a9eb13dfccfac432c46d96e" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension" }, "targets": [], "techniques": [], "vulnerabilities": [ "CVE-2026-20316" ] }, "report_id": "a6a9db68-3b87-4a75-b11c-b841f191138b", "schema_version": 1, "selected_date": "2026-09-07", "source_url": "https://socradar.io/blog/peep-browser-rat-chrome-extension" }