{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 1, "deduplicated_iocs": 64, "direct_entities": 172, "direct_relationships": 343, "invalid_iocs": 0, "iocs": 64, "mentioned": 7, "mitre_associated": 1, "mitre_direct": 0, "targets": 5, "techniques": 0, "unsupported_indicators": 32, "vulnerabilities": 2 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 229, "excluded_graph_objects": 1940, "graph_complete": true, "graph_objects": 172, "graph_relationships": 343, "mitre_context_complete": true, "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "status_as_of": "2026-10-10T03:52:55+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.689Z", "created_at": "2026-09-26T02:16:23.832Z", "modified": "2026-09-26T02:19:05.517Z", "updated_at": "2026-09-26T02:19:05.517Z" }, "description_available": false, "entity_type": "Indicator", "id": "0072d61c-6d01-4865-8246-0725c6e54b11", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--1933658f-7139-5f21-9afc-7f09b1cb9b3e", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:28.567Z", "updated_at": "2026-09-26T02:15:29.177Z" }, "description_available": false, "entity_type": "Url", "id": "00827ecb-07b5-4717-9f4e-29cbfced6eb8", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--cc2213fc-7a13-5413-85e8-2d9bf43327bc", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.671Z", "created_at": "2026-09-26T02:16:18.017Z", "modified": "2026-09-26T02:17:42.443Z", "updated_at": "2026-09-26T02:17:42.443Z" }, "description_available": false, "entity_type": "Indicator", "id": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--357d8c4a-bde6-5c6d-a712-e6e0daa17874", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.652Z", "created_at": "2026-09-26T02:16:05.899Z", "modified": "2026-09-26T02:17:15.264Z", "updated_at": "2026-09-26T02:17:15.264Z" }, "description_available": false, "entity_type": "Indicator", "id": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--5521075b-4e3a-5917-9b01-c8dc0ea13f51", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:32.616Z", "updated_at": "2026-09-26T02:14:33.064Z" }, "description_available": false, "entity_type": "StixFile", "id": "0400826f-b2c0-4aff-acf3-2ec6ccc4a9ca", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--beac1850-e6d8-51f5-925c-4c4320fd9e23", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:25.045Z", "updated_at": "2026-09-26T02:14:25.503Z" }, "description_available": false, "entity_type": "Hostname", "id": "0885fca1-e435-4ddc-a6f2-5df5ecd4ff6c", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--09274ed1-9db4-58be-a3a0-3bc6aa58bcdb", "type": "Hostname" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:25.762Z", "updated_at": "2026-09-26T02:15:27.194Z" }, "description_available": false, "entity_type": "Hostname", "id": "08bd69a6-c22b-4af8-9b6a-bad9e7025e27", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--b7edca0b-ac99-581f-a51f-95db38ed5f8e", "type": "Hostname" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:22.591Z", "updated_at": "2026-09-26T02:14:23.395Z" }, "description_available": false, "entity_type": "Hostname", "id": "08e46069-bd2e-4b5d-8bdc-de5a4ceacf25", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--e2583f66-1483-5e07-a8a7-19bfce38ff59", "type": "Hostname" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-09-03T20:17:24.210Z", "created_at": "2026-09-04T01:33:27.008Z", "modified": "2026-09-26T02:14:12.133Z", "updated_at": "2026-09-26T02:14:12.133Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-85046", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-85046", "id": "807c618d-1bb2-4b4b-90f3-b7b6a3dd9cad", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85046" }, { "external_id": null, "id": "bfac0631-6696-417d-afc8-31f15f2e5a7e", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md" }, { "external_id": null, "id": "0cf65735-575b-4531-a2df-e96bd090587d", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67" }, { "external_id": null, "id": "d8819ae5-9e3a-4ed7-9d3d-79b8d4a98f3c", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/" }, { "external_id": null, "id": "96905904-c5d4-4245-8db6-976eb3ac20aa", "source_name": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html" }, { "external_id": null, "id": "7890aae7-e7d1-4584-822b-8c138d1c05e3", "source_name": "chrome-cve-admin@google.com", "url": "https://issues.chromium.org/issues/542403045" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "vulnerability--8de7be87-e7b3-5254-aee1-87633393a683", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.611Z", "created_at": "2026-09-26T02:15:46.283Z", "modified": "2026-09-26T02:16:18.576Z", "updated_at": "2026-09-26T02:16:18.576Z" }, "description_available": false, "entity_type": "Indicator", "id": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--c1ea530d-db2b-53f7-a26d-55e34d01a85a", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:22.353Z", "updated_at": "2026-09-26T02:15:23.087Z" }, "description_available": false, "entity_type": "StixFile", "id": "127bcbba-f38a-49c8-890c-c734acc14afb", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--eb34a6b2-7b1a-58e2-ad13-8aee6a5f3912", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:37.431Z", "updated_at": "2026-09-26T02:14:38.075Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "134a3884-e439-4d6a-a889-bace089a0636", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--1c8ac786-13bd-5c7d-b5af-9040d559082f", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:16.407Z", "updated_at": "2026-09-26T02:15:16.968Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "1404b049-de33-4250-8426-69f3e5b168df", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--c71440db-bc73-5386-8fc6-fccfc99d8c9d", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:34.672Z", "updated_at": "2026-09-26T02:14:35.302Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "147f5db3-4484-4f3c-867b-970c8d6fb979", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--7a003a32-dab8-5d81-9db0-e6ba55d65a0e", "type": "DomainName" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:18.614Z", "updated_at": "2026-09-26T02:15:19.499Z" }, "description_available": false, "entity_type": "Hostname", "id": "15790dd0-fbaa-432f-b85a-408a7f4cae7a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--ebbf07b7-90ec-5518-9a77-7dc89ba611fa", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:18.611Z", "updated_at": "2026-09-26T02:15:19.636Z" }, "description_available": false, "entity_type": "StixFile", "id": "17305616-ea7d-46c7-b74d-756e1d528ebe", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--2cd48526-4300-5f19-8da0-1e7b8d1a5a32", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:24.755Z", "updated_at": "2026-09-26T02:14:25.105Z" }, "description_available": false, "entity_type": "Hostname", "id": "17803863-37e3-4ced-940a-96e1cc05301d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--f9ba7909-ae9b-5946-b411-25d3f6120673", "type": "Hostname" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:34.686Z", "updated_at": "2026-09-26T02:14:35.504Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "1ef6c578-25f9-4fb3-9485-c7f5cbcc2d3f", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--8f66b61f-ccf2-546a-8547-c4274de428d1", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:58.123Z", "updated_at": "2026-09-26T02:14:59.749Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "1f7879c7-86b7-483c-82a2-6d1641e67bf4", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--39647371-62fd-51ff-9c22-1b4879667ce5", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.700Z", "created_at": "2026-09-26T02:16:26.412Z", "modified": "2026-09-26T02:19:15.931Z", "updated_at": "2026-09-26T02:19:15.931Z" }, "description_available": false, "entity_type": "Indicator", "id": "21107844-453c-4c82-8366-9715c47845ee", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--2ca99ac2-8d1a-5538-b3a5-cf1a3fec87ce", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.640Z", "created_at": "2026-09-26T02:15:59.303Z", "modified": "2026-09-26T02:16:59.677Z", "updated_at": "2026-09-26T02:16:59.677Z" }, "description_available": false, "entity_type": "Indicator", "id": "2246fa10-784d-46a8-9813-e48a9c264f7b", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--598cf0a2-4261-5677-b099-166a4930cc18", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.662Z", "created_at": "2026-09-26T02:16:10.554Z", "modified": "2026-09-26T02:17:28.088Z", "updated_at": "2026-09-26T02:17:28.088Z" }, "description_available": false, "entity_type": "Indicator", "id": "2544bc40-2f3a-4168-998a-305476eabfbe", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--cb6db30a-5fb6-50da-bed6-e0186e3ba34e", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:36.948Z", "updated_at": "2026-09-26T02:14:37.775Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "259cd2d3-0e4a-46bb-b64f-679a8d1abb32", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--8f02e311-c42a-5fdd-b416-9668771f093d", "type": "DomainName" }, { "__typename": "Sector", "aliases": [ "Charitable Organizations", "Environmental", "Human Rights", "Humanitarian", "NGO", "Non-Profit" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.396Z", "created_at": "2026-01-18T14:35:16.788Z", "modified": "2026-03-02T08:10:37.845Z", "updated_at": "2026-03-02T08:10:37.845Z" }, "description_available": true, "entity_type": "Sector", "id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "is_inferred": false, "labels": [], "lang": "en", "name": "Non-Governmental Organizations (NGOs)", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "identity--35e12adc-e1a7-569a-a43f-76ac93cc5885", "type": "Sector" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:24.278Z", "updated_at": "2026-09-26T02:15:24.859Z" }, "description_available": false, "entity_type": "Hostname", "id": "27220f9c-2118-42fb-b51c-a7a79a25e15e", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--2bdaf1f5-e169-51e9-a391-680a7d63d62d", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.760Z", "created_at": "2026-09-26T02:16:52.981Z", "modified": "2026-09-26T02:20:44.280Z", "updated_at": "2026-09-26T02:20:44.280Z" }, "description_available": false, "entity_type": "Indicator", "id": "322d5ef5-edf0-4378-9ca3-8586882f8689", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--0e7401e8-dd94-595c-a12f-5eb4af1172e5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.616Z", "created_at": "2026-09-26T02:15:47.676Z", "modified": "2026-09-26T02:16:25.066Z", "updated_at": "2026-09-26T02:16:25.066Z" }, "description_available": false, "entity_type": "Indicator", "id": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--0859fd7a-0e49-5ce6-81da-881f6f88ccd8", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.692Z", "created_at": "2026-09-26T02:16:24.577Z", "modified": "2026-09-26T02:19:09.195Z", "updated_at": "2026-09-26T02:19:09.195Z" }, "description_available": false, "entity_type": "Indicator", "id": "35638839-e7f8-400f-b53f-151f43a9747e", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--6a305745-657b-5a5f-a266-b9a70203e789", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.731Z", "created_at": "2026-09-26T02:16:43.542Z", "modified": "2026-09-26T02:20:00.142Z", "updated_at": "2026-09-26T02:20:00.142Z" }, "description_available": false, "entity_type": "Indicator", "id": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--91b0acd3-f6e0-55b4-8f4c-cc16a0a91234", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.648Z", "created_at": "2026-09-26T02:16:03.566Z", "modified": "2026-09-26T02:17:05.525Z", "updated_at": "2026-09-26T02:17:05.525Z" }, "description_available": false, "entity_type": "Indicator", "id": "3830d40b-1944-4ae1-a28b-8071959397c5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--d2a5e9b5-66ab-52c7-a529-882f1d7e2531", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.698Z", "created_at": "2026-09-26T02:16:26.418Z", "modified": "2026-09-26T02:19:20.534Z", "updated_at": "2026-09-26T02:19:20.534Z" }, "description_available": false, "entity_type": "Indicator", "id": "39347496-5229-494f-9602-405597e9e186", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--06cabbe9-40ec-5704-8ae0-707cc26e6993", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:05.968Z", "updated_at": "2026-09-26T02:15:06.773Z" }, "description_available": false, "entity_type": "StixFile", "id": "3a8f5384-8175-4b0a-9b19-c6f11c754628", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--e4e551d9-7551-51f0-9421-d585540a5e85", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:16.592Z", "updated_at": "2026-09-26T02:15:17.238Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "3d665fa0-7683-4e30-8da6-c91cf0f1d680", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--77a2b470-ddc9-5296-bd39-7e2bb05c8a26", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:44.212Z", "updated_at": "2026-09-26T02:14:44.646Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "3e3c8219-b4e4-479f-9107-ceac88643e9d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--9eba39c8-fe71-53db-be3c-655545a2d541", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:27.092Z", "updated_at": "2026-09-26T02:14:28.947Z" }, "description_available": false, "entity_type": "Url", "id": "3e7fec84-f94e-4720-b965-aef3172a3563", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--70d7e61c-4872-5e0c-bd14-5761d0dea260", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:32.673Z", "updated_at": "2026-09-26T02:14:33.064Z" }, "description_available": false, "entity_type": "StixFile", "id": "406be21b-1340-4a85-ae2c-f95f004e46a7", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--55de41c0-1352-522e-b2fa-8b59b0b06059", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:16.589Z", "updated_at": "2026-09-26T02:15:17.117Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "40b390b3-3161-426e-8605-046ed49959d5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--efddd6ed-74c4-59d2-ba23-2f2768f30195", "type": "DomainName" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:13.294Z", "updated_at": "2026-09-26T02:15:14.988Z" }, "description_available": false, "entity_type": "Hostname", "id": "42e8572c-e512-48bc-9f33-4ffa9a8cb4f7", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--61bf5eba-c874-5376-896a-b015f4a0f429", "type": "Hostname" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-09-08T00:00:00.000Z", "created_at": "2026-09-08T19:50:53.010Z", "modified": "2026-09-26T23:57:05.813Z", "updated_at": "2026-09-26T23:57:05.813Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "4458b114-0fe4-4d79-beea-3b281c045e08", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-85880", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-85880", "id": "53b2e9a0-d45a-472a-bf43-428cf2b4fab4", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85880" }, { "external_id": null, "id": "73d9a2bd-b93c-471d-a51c-57d205ecb50b", "source_name": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "vulnerability--403fa317-e88d-592c-8941-59a0ea7bcc27", "type": "Vulnerability" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:34.413Z", "updated_at": "2026-09-26T02:15:34.936Z" }, "description_available": false, "entity_type": "Hostname", "id": "48efcbc8-2caf-47cc-a83d-5983beef2772", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--315d8093-652b-5122-b99e-67dda0c30ed0", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.673Z", "created_at": "2026-09-26T02:16:18.356Z", "modified": "2026-09-26T02:17:45.557Z", "updated_at": "2026-09-26T02:17:45.557Z" }, "description_available": false, "entity_type": "Indicator", "id": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--85cc1ce6-bb4e-5569-8a90-f7918361bcdf", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:31.088Z", "updated_at": "2026-09-26T02:15:31.877Z" }, "description_available": false, "entity_type": "Url", "id": "4d0e460f-4bbe-433e-a324-fc8500e89552", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--f93b4fc8-0373-5762-97d4-01c8e5f0c8f2", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.769Z", "created_at": "2026-09-26T02:16:56.191Z", "modified": "2026-09-29T16:47:44.664Z", "updated_at": "2026-09-29T16:47:44.664Z" }, "description_available": false, "entity_type": "Indicator", "id": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--786e6d16-fd4d-5eb9-a7f6-35904998adb3", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:34.023Z", "updated_at": "2026-09-26T02:15:34.766Z" }, "description_available": false, "entity_type": "Hostname", "id": "4de21850-3b3b-4151-b8b2-a3a9bca79791", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--5a68d5ea-956d-5f70-9353-ee466d5e334a", "type": "Hostname" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:42.405Z", "updated_at": "2026-09-26T02:14:43.122Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "4df2990c-e4dc-457c-9dad-4f8d2a2cb427", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--062c8ac8-35d6-5f05-99dc-8f23fea23f7c", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.711Z", "created_at": "2026-09-26T02:16:32.917Z", "modified": "2026-09-26T02:19:32.880Z", "updated_at": "2026-09-26T02:19:32.880Z" }, "description_available": false, "entity_type": "Indicator", "id": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--91ab1ca6-e48e-522b-9fdd-fc8f1a879b82", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.723Z", "created_at": "2026-09-26T02:16:39.077Z", "modified": "2026-09-26T02:19:50.955Z", "updated_at": "2026-09-26T02:19:50.955Z" }, "description_available": false, "entity_type": "Indicator", "id": "5362aa72-f60c-4284-807f-56610dba2887", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--637efec9-78ae-50c1-a801-cfd6d6794d96", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:09.639Z", "updated_at": "2026-09-26T02:15:11.868Z" }, "description_available": false, "entity_type": "Hostname", "id": "53c3c310-d81e-49ed-b992-5d808c28c51b", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--f2aab906-e4cb-51d2-a5c2-d340240edc0d", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:20.550Z", "updated_at": "2026-09-26T02:15:21.930Z" }, "description_available": false, "entity_type": "StixFile", "id": "54a4c15c-2a7f-4ec3-a5dc-1fffc1ca9a3c", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--fcf76092-3a56-5c49-b961-400b3499629e", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:13.294Z", "updated_at": "2026-09-26T02:15:14.989Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "576a1cda-087b-4df2-b8d3-6b179cbd7a18", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--8bb1c52d-cc91-590b-b4ff-083c1d4cc81e", "type": "DomainName" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.460Z", "created_at": "2026-09-26T02:14:05.010Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T02:14:05.604Z", "updated_at": "2026-09-26T02:14:05.604Z" }, "description_available": false, "entity_type": "Malware", "id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "is_inferred": false, "labels": [], "lang": "en", "name": "GemStone", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "malware--dc70ad45-d723-554e-aedb-73a2f7a71f0f", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.777Z", "created_at": "2026-09-26T02:17:00.278Z", "modified": "2026-09-29T16:47:45.943Z", "updated_at": "2026-09-29T16:47:45.943Z" }, "description_available": false, "entity_type": "Indicator", "id": "59d5d604-dce0-4819-9e20-9483824295de", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--dbb54670-e97d-54fb-a118-13b8ed4f86d8", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.625Z", "created_at": "2026-09-26T02:15:53.525Z", "modified": "2026-09-29T16:47:45.691Z", "updated_at": "2026-09-29T16:47:45.691Z" }, "description_available": false, "entity_type": "Indicator", "id": "5b501bee-c49c-41d2-a310-86863ba584cc", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--d29385cb-6260-5566-ba36-2e79acb3fd6e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.642Z", "created_at": "2026-09-26T02:16:01.601Z", "modified": "2026-09-26T02:17:01.745Z", "updated_at": "2026-09-26T02:17:01.745Z" }, "description_available": false, "entity_type": "Indicator", "id": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--06fb809b-368f-5d78-b26b-7e592dd84ead", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:23.478Z", "updated_at": "2026-09-26T02:15:24.136Z" }, "description_available": false, "entity_type": "StixFile", "id": "5e10a076-cfa4-406c-b414-239ab3d85b3a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--f05d8fbe-3914-5144-92ba-c62707357ae3", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:17.942Z", "updated_at": "2026-09-26T02:15:18.672Z" }, "description_available": false, "entity_type": "Hostname", "id": "5f548518-0667-4728-9c44-c960cb03c0ab", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--0a2b9ade-7660-5736-be20-d0abf11f2512", "type": "Hostname" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:49.034Z", "updated_at": "2026-09-26T02:14:50.693Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "6198de79-85e0-4ab6-adb6-f1dca49a28e0", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--49db8cb9-8c8c-5c61-b42c-16c33349c928", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:31.352Z", "updated_at": "2026-09-26T02:14:32.107Z" }, "description_available": false, "entity_type": "Url", "id": "622a3c64-719a-4bf2-a389-817b4c1092d5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--93888119-cbdb-5713-bd70-fae7da82e38b", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.633Z", "created_at": "2026-09-26T02:15:56.012Z", "modified": "2026-09-29T16:47:43.898Z", "updated_at": "2026-09-29T16:47:43.898Z" }, "description_available": false, "entity_type": "Indicator", "id": "6374cee3-22fc-480b-babc-255ef28c2ad9", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--3a4f8223-cceb-51d1-8d00-a80979642e2b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.621Z", "created_at": "2026-09-26T02:15:52.960Z", "modified": "2026-09-26T02:16:38.547Z", "updated_at": "2026-09-26T02:16:38.547Z" }, "description_available": false, "entity_type": "Indicator", "id": "65d6b799-01bf-4037-a390-c9d8f96014f3", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--f87e42a9-ecd8-531e-9ad9-27417c0d812e", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:37.434Z", "updated_at": "2026-09-26T02:14:38.076Z" }, "description_available": false, "entity_type": "Hostname", "id": "6655b2d3-90b8-48d5-8d24-bd35ee22e55a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--3b168c23-b390-53e7-abe3-e13e8d99284f", "type": "Hostname" }, { "__typename": "Sector", "aliases": [ "Financial", "Financial Industry (FI)", "Financial Services", "Financial-Services" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.391Z", "created_at": "2026-01-18T14:35:07.063Z", "modified": "2026-01-22T20:49:24.280Z", "updated_at": "2026-01-22T20:49:24.280Z" }, "description_available": true, "entity_type": "Sector", "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "is_inferred": false, "labels": [], "lang": "en", "name": "Finance", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7", "type": "Sector" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:44.583Z", "updated_at": "2026-09-26T02:14:45.314Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "68d8a6cb-a0af-427d-8b9d-ea6b86f1023d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--7c4c9401-2fc2-5e02-ac09-d2e950c1ad64", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:41.976Z", "updated_at": "2026-09-26T02:14:42.259Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "68f15535-f7a0-469d-a28a-d76753faccf2", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--aa56d424-9a50-5810-b174-3a705584dfc3", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.664Z", "created_at": "2026-09-26T02:16:14.614Z", "modified": "2026-09-26T02:17:30.553Z", "updated_at": "2026-09-26T02:17:30.553Z" }, "description_available": false, "entity_type": "Indicator", "id": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--ae8597bf-1b1d-50d6-ae52-c779eeac6508", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.596Z", "created_at": "2026-09-26T02:15:37.450Z", "modified": "2026-09-26T02:15:47.251Z", "updated_at": "2026-09-26T02:15:47.251Z" }, "description_available": false, "entity_type": "Indicator", "id": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--b4e3d5df-26dd-5193-b2a9-49b42b112292", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:30.079Z", "updated_at": "2026-09-26T02:15:30.772Z" }, "description_available": false, "entity_type": "Url", "id": "6f90eb7f-de7b-4cf4-b400-fc7764e46ceb", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--8b994c3e-ff86-547a-9db2-e393c9de6c94", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:15.845Z", "updated_at": "2026-09-26T02:14:17.153Z" }, "description_available": false, "entity_type": "StixFile", "id": "722948a5-a24a-4935-9d91-4c7d88ed7ee3", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--1d553c0d-34f5-593b-86f7-09a6ab23579a", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.737Z", "created_at": "2026-09-26T02:16:45.622Z", "modified": "2026-09-26T02:20:10.626Z", "updated_at": "2026-09-26T02:20:10.626Z" }, "description_available": false, "entity_type": "Indicator", "id": "73ab01ce-8793-409b-8d77-693b01e232ac", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--30d88dbf-c415-5fca-b70c-0aaddd5809e0", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:44.559Z", "updated_at": "2026-09-26T02:14:45.178Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "75a38a71-04ed-4526-95d0-66d4435b1918", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--97b8f137-83c4-5542-831e-36a3c740426c", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.790Z", "created_at": "2026-09-26T02:17:04.858Z", "modified": "2026-09-26T02:21:18.980Z", "updated_at": "2026-09-26T02:21:18.980Z" }, "description_available": false, "entity_type": "Indicator", "id": "78758893-b8ff-478a-87c7-db3374492f48", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--5e12622c-04df-50f5-a97f-e67f2f595b3d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.683Z", "created_at": "2026-09-26T02:16:22.228Z", "modified": "2026-09-26T02:18:04.986Z", "updated_at": "2026-09-26T02:18:04.986Z" }, "description_available": false, "entity_type": "Indicator", "id": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--d6b27cc8-500d-5ebf-9076-3f5bef0b5cbf", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:26.219Z", "updated_at": "2026-09-26T02:14:26.642Z" }, "description_available": false, "entity_type": "Hostname", "id": "79ff1a9e-429a-4d0d-b2f6-9e38ca7a93aa", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--cd4dcba4-4c99-5f22-9fa8-19835607fc68", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.726Z", "created_at": "2026-09-26T02:16:43.197Z", "modified": "2026-09-26T02:19:58.035Z", "updated_at": "2026-09-26T02:19:58.035Z" }, "description_available": false, "entity_type": "Indicator", "id": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--ef8af916-009f-5813-b2f0-02790e6913e1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.591Z", "created_at": "2026-09-26T02:15:35.002Z", "modified": "2026-09-26T04:11:20.864Z", "updated_at": "2026-09-26T04:11:20.864Z" }, "description_available": false, "entity_type": "Indicator", "id": "7b853990-6802-4b75-8de1-2be0a39e6536", "is_inferred": false, "labels": [ "bluemoon", "browser extension", "browser-extension", "chrome exploitation", "cve-2026-85880", "gemstone", "grimwedge", "shadowpad", "spear-phishing", "zero-day" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--9502e6f5-6178-58c6-8533-52592ffdd37f", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:29.827Z", "updated_at": "2026-09-26T02:15:30.433Z" }, "description_available": false, "entity_type": "Url", "id": "7c3b12bd-7b05-4192-935f-6e71880b3070", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--9250d89f-5866-5d84-a1d4-9c79925042f6", "type": "Url" }, { "__typename": "Sector", "aliases": [ "ICS", "Industrial Control Systems", "Utilities", "industrial" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:12.982Z", "modified": "2026-02-05T15:16:55.400Z", "updated_at": "2026-02-05T15:16:55.400Z" }, "description_available": true, "entity_type": "Sector", "id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "is_inferred": false, "labels": [], "lang": "en", "name": "Manufacturing", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "identity--3b7bc57f-b0b6-5dc2-a816-6406ae1d6da1", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.747Z", "created_at": "2026-09-26T02:16:48.127Z", "modified": "2026-09-26T02:16:49.475Z", "updated_at": "2026-09-26T02:16:49.475Z" }, "description_available": false, "entity_type": "Indicator", "id": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--e3fb1431-47f8-58da-b252-ec35e0af1dad", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:05.936Z", "updated_at": "2026-09-26T02:15:06.768Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "839dc0d9-ef1a-4249-aeed-24dd1a7fdce6", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--9b2a5594-d3d3-562e-97be-4212b35a82d5", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:12.746Z", "updated_at": "2026-09-26T02:14:13.248Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "83b6823a-45e7-42c1-8865-d839e2f069e1", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--0b11ed06-36af-5ecc-98c9-3daecf394348", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.728Z", "created_at": "2026-09-26T02:16:43.526Z", "modified": "2026-09-26T02:20:05.639Z", "updated_at": "2026-09-26T02:20:05.639Z" }, "description_available": false, "entity_type": "Indicator", "id": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--f0e83e76-8aa0-56ef-b05a-aecb2798eac6", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.637Z", "created_at": "2026-09-26T02:15:58.349Z", "modified": "2026-09-29T16:47:42.815Z", "updated_at": "2026-09-29T16:47:42.815Z" }, "description_available": false, "entity_type": "Indicator", "id": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--01c35744-f1e3-5b64-9759-2d6d1100e0ae", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:50.798Z", "updated_at": "2026-09-26T02:14:51.407Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "884c37e7-7b29-42fc-be3a-ba2d5ddc16e5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--31247c92-e6bd-53fb-a40b-748171af38a4", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.623Z", "created_at": "2026-09-26T02:15:53.266Z", "modified": "2026-09-26T02:16:32.847Z", "updated_at": "2026-09-26T02:16:32.847Z" }, "description_available": false, "entity_type": "Indicator", "id": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--3aacaac6-bea5-5a8e-b3d5-937d513fba1b", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:54.219Z", "updated_at": "2026-09-26T02:14:56.623Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "893a0a60-708c-4e05-b761-8c87dc4b7486", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--62f3e030-aff4-596f-afcd-4cdb505f307f", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:26.089Z", "updated_at": "2026-09-26T02:15:28.071Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "897e57c8-32c1-4472-8a12-9cbe3b53a2b2", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--3e7f4f79-07f7-5e78-b22c-534daf35ea57", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.676Z", "created_at": "2026-09-26T02:16:21.085Z", "modified": "2026-09-26T02:17:54.569Z", "updated_at": "2026-09-26T02:17:54.569Z" }, "description_available": false, "entity_type": "Indicator", "id": "899bea10-a43c-4db4-b883-acb51ee48ca3", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--5d63bd7e-4945-5ae9-87b6-ccdf9a4a6135", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:05.952Z", "updated_at": "2026-09-26T02:15:06.772Z" }, "description_available": false, "entity_type": "StixFile", "id": "89e233b2-a13d-4a8a-9aea-20786f0d9044", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--9936656b-b7fd-56f6-8cc7-7aca1719672c", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.628Z", "created_at": "2026-09-26T02:15:55.226Z", "modified": "2026-09-29T16:47:44.092Z", "updated_at": "2026-09-29T16:47:44.092Z" }, "description_available": false, "entity_type": "Indicator", "id": "8a294068-ba4c-44c3-aa84-f37ee494decf", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--64df7522-3c52-5a0a-a118-79d02e77786e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.695Z", "created_at": "2026-09-26T02:16:26.021Z", "modified": "2026-09-26T02:19:12.924Z", "updated_at": "2026-09-26T02:19:12.924Z" }, "description_available": false, "entity_type": "Indicator", "id": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--fe963142-3af1-5bb8-99e8-86d9a8fc3042", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:29.821Z", "updated_at": "2026-09-26T02:15:30.431Z" }, "description_available": false, "entity_type": "Url", "id": "8b0a11b5-658b-4e90-a723-9a28f1aebb03", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--7814314a-c629-5e11-8747-f1ba1aa29cc3", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.685Z", "created_at": "2026-09-26T02:16:23.126Z", "modified": "2026-09-26T02:18:41.596Z", "updated_at": "2026-09-26T02:18:41.596Z" }, "description_available": false, "entity_type": "Indicator", "id": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--04990b1b-c018-5f3f-a73e-c0c029b0aac9", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:31.533Z", "updated_at": "2026-09-26T02:15:32.130Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "8e8f664d-e6b1-4b13-a8ae-3e8bd9619e52", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--a1ea7da3-c875-5004-9f36-7b5df44e5032", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:30.926Z", "updated_at": "2026-09-26T02:14:31.541Z" }, "description_available": false, "entity_type": "Url", "id": "8f41ac2c-e916-4724-b010-f9896e16c1fb", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--fb27ab99-c880-5115-a339-8a0a27fdce07", "type": "Url" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:22.766Z", "updated_at": "2026-09-26T02:14:23.783Z" }, "description_available": false, "entity_type": "Hostname", "id": "8f499bdc-631b-431a-9931-0ba823d160ec", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--cbc73afd-e253-5a91-be3d-ed3ab04ddcf1", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.687Z", "created_at": "2026-09-26T02:16:23.797Z", "modified": "2026-09-26T02:18:58.029Z", "updated_at": "2026-09-26T02:18:58.029Z" }, "description_available": false, "entity_type": "Indicator", "id": "908266a0-28c7-44da-97f2-c59ac89fc02d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--75805380-caf6-5433-ab13-ad8f70052fd7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.744Z", "created_at": "2026-09-26T02:16:47.124Z", "modified": "2026-09-26T02:20:16.352Z", "updated_at": "2026-09-26T02:20:16.352Z" }, "description_available": false, "entity_type": "Indicator", "id": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--3ac7b9c1-3d6b-5b39-a936-d368861723ba", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:23.930Z", "updated_at": "2026-09-26T02:15:24.856Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "92145f60-35b5-4180-a821-8d1fcc64de69", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--e71f35f2-13ca-56be-9ac1-14275141b3c8", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:54.848Z", "updated_at": "2026-09-26T02:14:56.624Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "93b015db-4a70-4d9b-b462-a41b1aeb0c54", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--6bb22fce-42e3-5d05-a6b5-747bada91ea5", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:53.170Z", "updated_at": "2026-09-26T02:14:56.621Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "93e44490-3da8-4ef2-9e1d-a6ef233e26f5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--515ea7ab-b2c0-56c5-b9f1-24cf3ce14129", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.794Z", "created_at": "2026-09-26T02:17:07.848Z", "modified": "2026-09-26T02:21:24.034Z", "updated_at": "2026-09-26T02:21:24.034Z" }, "description_available": false, "entity_type": "Indicator", "id": "94a25698-514c-48d5-9e05-a337aca9a1b0", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--683e98a4-edf1-5324-a5e6-816fca492821", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:32.553Z", "updated_at": "2026-09-26T02:14:33.062Z" }, "description_available": false, "entity_type": "StixFile", "id": "95d05541-4dfd-417b-9938-afe603a48f2a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--144efedc-7aa0-59b0-ba68-967050cd0f3b", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:31.091Z", "updated_at": "2026-09-26T02:15:31.878Z" }, "description_available": false, "entity_type": "StixFile", "id": "96641aba-b03d-47c0-b0f0-18d45e9ff5bb", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--47285645-61fa-5c1f-95e8-0c78b65a99a6", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:14.222Z", "updated_at": "2026-09-26T02:14:14.640Z" }, "description_available": false, "entity_type": "StixFile", "id": "99baaaa1-f038-4240-aa79-0ad013198c94", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--9c59f511-e26d-5596-803e-abbbd13ebc52", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:33.273Z", "updated_at": "2026-09-26T02:15:33.960Z" }, "description_available": false, "entity_type": "Hostname", "id": "9e5ea46a-800a-47c4-a6ce-863305dc479d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--3475602c-fe6f-5078-bbdd-9dd09d73042c", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.734Z", "created_at": "2026-09-26T02:16:45.461Z", "modified": "2026-09-26T02:20:07.288Z", "updated_at": "2026-09-26T02:20:07.288Z" }, "description_available": false, "entity_type": "Indicator", "id": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--8f85315a-543f-5824-89c1-d9cba8aed142", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:34.677Z", "updated_at": "2026-09-26T02:14:35.503Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "a3d00dbe-8076-4925-aaa0-beef5349d0e7", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--a46578ba-6239-5fb1-9d37-bbb1e0d4aaea", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.613Z", "created_at": "2026-09-26T02:15:47.455Z", "modified": "2026-09-26T02:16:22.411Z", "updated_at": "2026-09-26T02:16:22.411Z" }, "description_available": false, "entity_type": "Indicator", "id": "a604bb75-2767-4014-bfaa-f033d7a5df31", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--0efdd870-e1d0-5f15-8ab1-2d06aa4c248d", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:59.620Z", "updated_at": "2026-09-26T02:15:00.790Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "a782bd25-1b5c-4c7c-8955-fcdc8b283b06", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--2cdffecf-8187-58cd-8a47-287a56a58247", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:26.281Z", "updated_at": "2026-09-26T02:15:28.073Z" }, "description_available": false, "entity_type": "Url", "id": "a8296d14-60fc-4411-bfd6-8016ac7e0322", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--7f4e5666-c0c3-5140-bdce-5503ca13df74", "type": "Url" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:42.192Z", "updated_at": "2026-09-26T02:14:43.120Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "a9ecaf49-407d-42d8-8fc2-9c0dff497fac", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--08f685bf-28e1-5e8e-98a3-be913992a8f0", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:30.464Z", "updated_at": "2026-09-26T02:14:31.229Z" }, "description_available": false, "entity_type": "Url", "id": "aa2428da-1698-4a7d-a12e-45989e024aeb", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--4dcc552a-85c1-5335-b336-e12961c79756", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:09.474Z", "updated_at": "2026-09-26T02:15:11.865Z" }, "description_available": false, "entity_type": "StixFile", "id": "aaf6b22a-1e70-4626-8dec-f9b21f66fd42", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--24585b2a-dc4f-56b1-b2e9-b6ba55557af4", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.721Z", "created_at": "2026-09-26T02:16:39.073Z", "modified": "2026-09-26T02:19:46.775Z", "updated_at": "2026-09-26T02:19:46.775Z" }, "description_available": false, "entity_type": "Indicator", "id": "acd924c0-2829-463e-a00a-14a40a617329", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--6cb1efb0-45d8-5a4b-a308-b3ecc260b79e", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:27.955Z", "updated_at": "2026-09-26T02:14:30.336Z" }, "description_available": false, "entity_type": "Url", "id": "adfde137-8bff-4f27-8c2d-320d0de4f1da", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--abe6dabd-f066-575f-a58e-47c39333ff19", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.766Z", "created_at": "2026-09-26T02:16:56.091Z", "modified": "2026-09-29T16:47:43.431Z", "updated_at": "2026-09-29T16:47:43.431Z" }, "description_available": false, "entity_type": "Indicator", "id": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--14766cca-1264-5722-b58c-a6c6db28831a", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:14.081Z", "updated_at": "2026-09-26T02:14:14.573Z" }, "description_available": false, "entity_type": "StixFile", "id": "b218769f-9694-4cc8-a2f8-e5102a348bb7", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--cb76403e-8d1c-5025-97c6-4953fbbec410", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Aerospace", "Airline", "Aviation", "Satellite", "Satellite and communications" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:05.210Z", "modified": "2026-03-03T16:11:36.002Z", "updated_at": "2026-03-03T16:11:36.002Z" }, "description_available": true, "entity_type": "Sector", "id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "is_inferred": false, "labels": [], "lang": "en", "name": "Air transport", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "identity--f70238bb-1aaa-57af-800b-91806caa8abb", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.598Z", "created_at": "2026-09-26T02:15:40.396Z", "modified": "2026-09-26T02:15:55.508Z", "updated_at": "2026-09-26T02:15:55.508Z" }, "description_available": false, "entity_type": "Indicator", "id": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--ce785378-fb68-5b35-8832-912780cba796", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.606Z", "created_at": "2026-09-26T02:15:43.965Z", "modified": "2026-09-26T02:16:08.400Z", "updated_at": "2026-09-26T02:16:08.400Z" }, "description_available": false, "entity_type": "Indicator", "id": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--8088b24d-1e2b-5480-8c70-5a4146fe856e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.787Z", "created_at": "2026-09-26T02:17:04.552Z", "modified": "2026-09-26T02:21:16.718Z", "updated_at": "2026-09-26T02:21:16.718Z" }, "description_available": false, "entity_type": "Indicator", "id": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--465146ba-80ed-526c-bfc8-4be3d4d6d8e4", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:09.473Z", "updated_at": "2026-09-26T02:15:11.863Z" }, "description_available": false, "entity_type": "StixFile", "id": "b755ca83-8714-4ce4-8dd2-5907570a1461", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--d3834f27-fdc6-5180-9f78-d664511abe66", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.659Z", "created_at": "2026-09-26T02:16:09.402Z", "modified": "2026-09-26T02:17:24.010Z", "updated_at": "2026-09-26T02:17:24.010Z" }, "description_available": false, "entity_type": "Indicator", "id": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--c7c03907-93eb-5e10-9514-3dfeb76852f9", "type": "Indicator" }, { "__typename": "Sector", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.396Z", "created_at": "2026-01-18T14:35:16.665Z", "modified": "2026-01-18T14:35:16.847Z", "updated_at": "2026-01-18T14:35:16.847Z" }, "description_available": true, "entity_type": "Sector", "id": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "is_inferred": false, "labels": [], "lang": "en", "name": "Civil society", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "identity--ec578e61-1405-5026-ac57-d940919605c6", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.594Z", "created_at": "2026-09-26T02:15:37.296Z", "modified": "2026-09-26T02:15:53.056Z", "updated_at": "2026-09-26T02:15:53.056Z" }, "description_available": false, "entity_type": "Indicator", "id": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--f129e86b-6551-5a98-bc84-ec52acdbf3fc", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.680Z", "created_at": "2026-09-26T02:16:21.993Z", "modified": "2026-09-26T02:16:22.567Z", "updated_at": "2026-09-26T02:16:22.567Z" }, "description_available": false, "entity_type": "Indicator", "id": "bad82237-3d91-4def-8766-61d38b70be49", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--84826802-3085-54fe-8170-a70c0d252e3c", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:15.605Z", "updated_at": "2026-09-26T02:14:17.010Z" }, "description_available": false, "entity_type": "StixFile", "id": "bafbda59-e819-4f08-90ad-1ad447bd47af", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--6280734a-9a17-590f-91e5-185cd1554dd5", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Shipping", "Transportation" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:04.772Z", "modified": "2026-01-25T08:44:52.215Z", "updated_at": "2026-01-25T08:44:52.215Z" }, "description_available": true, "entity_type": "Sector", "id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "is_inferred": false, "labels": [], "lang": "en", "name": "Transport", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "identity--4a5a8971-1cd1-5a11-8843-267e17b105ac", "type": "Sector" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:19.798Z", "updated_at": "2026-09-26T02:14:20.281Z" }, "description_available": false, "entity_type": "StixFile", "id": "bbeffa1c-3e6b-4cf3-b27b-3eece4197be7", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--797b1430-a992-564e-9248-2112c739a676", "type": "StixFile" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:29.389Z", "updated_at": "2026-09-26T02:15:29.724Z" }, "description_available": false, "entity_type": "Url", "id": "bd54d4ad-ddce-4d25-8584-d692e2f5756d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--2b2b692f-269e-5dd0-a363-a588802f959b", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.752Z", "created_at": "2026-09-26T02:16:50.874Z", "modified": "2026-09-26T02:20:31.497Z", "updated_at": "2026-09-26T02:20:31.497Z" }, "description_available": false, "entity_type": "Indicator", "id": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--377bdf2f-5f4c-585f-b727-fe4eb0bbdd8e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.703Z", "created_at": "2026-09-26T02:16:30.418Z", "modified": "2026-09-26T02:19:23.498Z", "updated_at": "2026-09-26T02:19:23.498Z" }, "description_available": false, "entity_type": "Indicator", "id": "bfda401c-dab3-403d-9abc-99fe172d3865", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--69a44acd-1fc9-55dc-af6d-40b36587ba09", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.668Z", "created_at": "2026-09-26T02:16:16.233Z", "modified": "2026-09-26T02:17:39.191Z", "updated_at": "2026-09-26T02:17:39.191Z" }, "description_available": false, "entity_type": "Indicator", "id": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--e837a5c2-28f8-51dc-9d82-aac8ce556da0", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.635Z", "created_at": "2026-09-26T02:15:58.354Z", "modified": "2026-09-29T16:47:46.145Z", "updated_at": "2026-09-29T16:47:46.145Z" }, "description_available": false, "entity_type": "Indicator", "id": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--e1994430-ce66-525c-9560-23a287b7e845", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.779Z", "created_at": "2026-09-26T02:17:02.566Z", "modified": "2026-09-29T16:47:45.127Z", "updated_at": "2026-09-29T16:47:45.127Z" }, "description_available": false, "entity_type": "Indicator", "id": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--9daf8503-2063-50e8-b5c7-80460e01a5a9", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.645Z", "created_at": "2026-09-26T02:16:02.092Z", "modified": "2026-09-26T02:17:03.670Z", "updated_at": "2026-09-26T02:17:03.670Z" }, "description_available": false, "entity_type": "Indicator", "id": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--a20f072e-e9b3-54d3-a078-08123bc691a2", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:58.141Z", "updated_at": "2026-09-26T02:14:59.748Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "c710d1c7-ba63-4ec5-b172-443637ee9022", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--74565951-dcf4-5b04-8641-e6dec3294c24", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:13.288Z", "updated_at": "2026-09-26T02:15:14.986Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "c76493a8-5da7-43b4-8bae-961abf2b98b3", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--f6ebd84b-09fa-5de7-b20b-ca7a51b25719", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.666Z", "created_at": "2026-09-26T02:16:15.229Z", "modified": "2026-09-26T02:17:36.887Z", "updated_at": "2026-09-26T02:17:36.887Z" }, "description_available": false, "entity_type": "Indicator", "id": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--9499309f-2818-53e9-a8c8-46650307854f", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:28.868Z", "updated_at": "2026-09-26T02:15:29.178Z" }, "description_available": false, "entity_type": "Url", "id": "cc521352-21dd-488f-bbf6-9b20ac1d1a26", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--3024e453-7930-5513-a864-e7e92e7df6db", "type": "Url" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:47.092Z", "updated_at": "2026-09-26T02:14:50.278Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "cf3f2241-a684-4462-90e6-a7be1d592547", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--3d4f47d8-364a-557c-b824-0b033b30d9d2", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.719Z", "created_at": "2026-09-26T02:16:38.922Z", "modified": "2026-09-26T02:19:54.380Z", "updated_at": "2026-09-26T02:19:54.380Z" }, "description_available": false, "entity_type": "Indicator", "id": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--a7f23e28-9678-5049-87c4-14efbfb0e3af", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.601Z", "created_at": "2026-09-26T02:15:40.717Z", "modified": "2026-09-26T02:15:58.382Z", "updated_at": "2026-09-26T02:15:58.382Z" }, "description_available": false, "entity_type": "Indicator", "id": "d3255eff-0896-4e01-b407-e19ec06bae9c", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--89292592-e825-5df6-a1c8-5ed109c227b5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.716Z", "created_at": "2026-09-26T02:16:32.926Z", "modified": "2026-09-26T02:19:40.437Z", "updated_at": "2026-09-26T02:19:40.437Z" }, "description_available": false, "entity_type": "Indicator", "id": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--15bcbdcf-9875-579e-9366-d37a5ef653a2", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.774Z", "created_at": "2026-09-26T02:17:00.262Z", "modified": "2026-09-29T16:47:44.918Z", "updated_at": "2026-09-29T16:47:44.918Z" }, "description_available": false, "entity_type": "Indicator", "id": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--92af0ede-738f-5292-8a61-bbcd9d16d2fc", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.741Z", "created_at": "2026-09-26T02:16:45.622Z", "modified": "2026-09-26T02:20:13.150Z", "updated_at": "2026-09-26T02:20:13.150Z" }, "description_available": false, "entity_type": "Indicator", "id": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--b07c0a92-4be5-5216-a377-8720da9b1e70", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.782Z", "created_at": "2026-09-26T02:17:02.566Z", "modified": "2026-09-26T02:21:09.151Z", "updated_at": "2026-09-26T02:21:09.151Z" }, "description_available": false, "entity_type": "Indicator", "id": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--42eea527-5bf6-5ccd-902e-395ca19d6f7f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.604Z", "created_at": "2026-09-26T02:15:40.721Z", "modified": "2026-09-26T02:16:03.259Z", "updated_at": "2026-09-26T02:16:03.259Z" }, "description_available": false, "entity_type": "Indicator", "id": "dd901a81-11dd-4326-9220-8c317d33c0d1", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--36f73180-ceb5-5dbc-b495-53304c63f001", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.618Z", "created_at": "2026-09-26T02:15:50.238Z", "modified": "2026-09-26T02:16:30.203Z", "updated_at": "2026-09-26T02:16:30.203Z" }, "description_available": false, "entity_type": "Indicator", "id": "de7c3530-8b9e-4f86-9503-42f21e038f33", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--a253592d-2282-5a5e-ab14-9b84af290214", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.460Z", "created_at": "2026-09-26T02:14:04.958Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T02:14:05.441Z", "updated_at": "2026-09-26T02:14:05.441Z" }, "description_available": false, "entity_type": "Malware", "id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "is_inferred": false, "labels": [], "lang": "en", "name": "BlueMoon", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "malware--3da0b064-b14c-584e-bba6-da1459e74118", "type": "Malware" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.708Z", "created_at": "2026-09-26T02:16:30.743Z", "modified": "2026-09-26T02:19:28.272Z", "updated_at": "2026-09-26T02:19:28.272Z" }, "description_available": false, "entity_type": "Indicator", "id": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--f04146f7-eef4-548e-98c0-a077134bf075", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.650Z", "created_at": "2026-09-26T02:16:05.893Z", "modified": "2026-09-26T02:17:09.928Z", "updated_at": "2026-09-26T02:17:09.928Z" }, "description_available": false, "entity_type": "Indicator", "id": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--9a7e1319-a5c4-537b-9c04-4c206c30405a", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:25.090Z", "updated_at": "2026-09-26T02:14:25.703Z" }, "description_available": false, "entity_type": "Hostname", "id": "e26f54a6-3647-487e-aa95-721f6796d399", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "hostname--ba16bfef-caa8-5d13-84ed-e5dfceb7b518", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.757Z", "created_at": "2026-09-26T02:16:51.543Z", "modified": "2026-09-26T02:20:37.270Z", "updated_at": "2026-09-26T02:20:37.270Z" }, "description_available": false, "entity_type": "Indicator", "id": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--f1967135-d40e-5506-9310-ce1e3770c1e4", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:15:20.874Z", "updated_at": "2026-09-26T02:15:22.262Z" }, "description_available": false, "entity_type": "StixFile", "id": "e4f6be0b-7b68-444c-b386-aed034c5e4ab", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "file--64ef7768-0fb4-59ab-a058-657dcb2887e7", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:19.795Z", "updated_at": "2026-09-26T02:14:20.282Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "e5dad1ca-bf44-47ea-b552-5355d7c65a2f", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--113d6fa2-5937-5d6d-aba1-92fb9a666035", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:12.836Z", "updated_at": "2026-09-26T04:11:05.826Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "e9275624-f8c9-4dc3-9f18-811a12adc346", "is_inferred": false, "labels": [ "bluemoon", "browser extension", "browser-extension", "chrome exploitation", "cve-2026-85880", "gemstone", "grimwedge", "shadowpad", "spear-phishing", "zero-day" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "domain-name--7f80975d-6315-5ba4-8992-41f9cfc335c2", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.749Z", "created_at": "2026-09-26T02:16:48.126Z", "modified": "2026-09-26T02:20:19.826Z", "updated_at": "2026-09-26T02:20:19.826Z" }, "description_available": false, "entity_type": "Indicator", "id": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--488fe763-844a-59dc-859a-a8da2866ac60", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.609Z", "created_at": "2026-09-26T02:15:45.581Z", "modified": "2026-09-26T02:16:15.090Z", "updated_at": "2026-09-26T02:16:15.090Z" }, "description_available": false, "entity_type": "Indicator", "id": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--82ee6fee-24a7-5b36-8773-9531f0ab4d5e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.706Z", "created_at": "2026-09-26T02:16:30.734Z", "modified": "2026-09-26T02:19:31.093Z", "updated_at": "2026-09-26T02:19:31.093Z" }, "description_available": false, "entity_type": "Indicator", "id": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--c875bff9-ecfe-57eb-9be2-009cc65ae486", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.713Z", "created_at": "2026-09-26T02:16:32.922Z", "modified": "2026-09-26T02:19:43.596Z", "updated_at": "2026-09-26T02:19:43.596Z" }, "description_available": false, "entity_type": "Indicator", "id": "f3c13de1-2b2f-4a16-aed6-e76678178416", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--d169d7dd-7dca-59a6-b62d-2770b0df228e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.630Z", "created_at": "2026-09-26T02:15:55.251Z", "modified": "2026-09-29T16:47:44.372Z", "updated_at": "2026-09-29T16:47:44.372Z" }, "description_available": false, "entity_type": "Indicator", "id": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--6cc853fc-a4d7-5a3f-9fa6-0bbf2af455c7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.657Z", "created_at": "2026-09-26T02:16:09.071Z", "modified": "2026-09-26T02:17:19.910Z", "updated_at": "2026-09-26T02:17:19.910Z" }, "description_available": false, "entity_type": "Indicator", "id": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--cdc07a44-65c8-53de-b80c-5c2717422698", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.655Z", "created_at": "2026-09-26T02:16:08.007Z", "modified": "2026-09-26T02:17:17.267Z", "updated_at": "2026-09-26T02:17:17.267Z" }, "description_available": false, "entity_type": "Indicator", "id": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--034388c8-0557-55d6-8364-e5fd935c5ef1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.785Z", "created_at": "2026-09-26T02:17:02.558Z", "modified": "2026-09-29T16:47:43.661Z", "updated_at": "2026-09-29T16:47:43.661Z" }, "description_available": false, "entity_type": "Indicator", "id": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--1fbb81b6-d12f-5514-a58d-c5cbecb29b38", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:23:00.041Z", "created_at": "2026-02-06T21:11:44.284Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-02-06T21:11:44.805Z", "updated_at": "2026-02-06T21:11:44.805Z" }, "description_available": false, "entity_type": "Malware", "id": "fab79403-9d60-420c-bc87-42b644d12f6d", "is_inferred": false, "labels": [], "lang": "en", "name": "ShadowPad - S0596", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "malware--4edb8b8a-6948-5841-80c3-46da68f5c6a9", "type": "Malware" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T02:14:26.858Z", "updated_at": "2026-09-26T02:14:27.555Z" }, "description_available": false, "entity_type": "Url", "id": "fbb098b4-67dc-4979-8650-344c43ffd62a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "url--7765de0e-e0c1-5cf7-a299-78b1f2b08f95", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.771Z", "created_at": "2026-09-26T02:17:00.271Z", "modified": "2026-09-29T16:47:43.241Z", "updated_at": "2026-09-29T16:47:43.241Z" }, "description_available": false, "entity_type": "Indicator", "id": "fbc204e0-b73d-4c21-b240-532955b5d524", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--0200a5a1-038d-5ff6-bfd4-a7b7cc67e058", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.792Z", "created_at": "2026-09-26T02:17:04.896Z", "modified": "2026-09-26T02:21:21.773Z", "updated_at": "2026-09-26T02:21:21.773Z" }, "description_available": false, "entity_type": "Indicator", "id": "fbdda215-d56a-448f-a95c-665f7567d62a", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--a1ead0f8-7780-5720-84c5-b4cdd0d8dfcb", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.763Z", "created_at": "2026-09-26T02:16:56.064Z", "modified": "2026-09-29T16:47:45.479Z", "updated_at": "2026-09-29T16:47:45.479Z" }, "description_available": false, "entity_type": "Indicator", "id": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--a16a4aae-8a6f-56d4-9e42-2ca93fe35835", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.755Z", "created_at": "2026-09-26T02:16:51.539Z", "modified": "2026-09-26T02:20:39.226Z", "updated_at": "2026-09-26T02:20:39.226Z" }, "description_available": false, "entity_type": "Indicator", "id": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "indicator--659c1533-a8ba-5678-bba6-6064f5eef9b1", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.259Z", "created_at": "2026-09-26T02:33:26.791Z", "modified": "2026-09-26T02:33:27.079Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:27.079Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_id": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_name": null, "from_type": "Indicator", "id": "027fd3a7-2c20-4a67-902b-01cff8f9c823", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5f3aad4a-daf1-5cff-949d-ec4b974422e4", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.854Z", "created_at": "2026-09-26T02:23:55.144Z", "modified": "2026-09-26T02:23:55.315Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:55.315Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_id": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_name": null, "from_type": "Indicator", "id": "030b2202-7ea5-414f-be66-d392618b1a5d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--763ab722-f3f1-5c2c-9ac9-01f15b1c7700", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.114Z", "created_at": "2026-09-26T02:29:30.373Z", "modified": "2026-09-26T02:29:30.549Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:30.549Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_id": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_name": null, "from_type": "Indicator", "id": "04393f4e-3341-4d8a-9dc3-8a89ef42abc6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--62893c76-094d-59ee-b7d9-9e488ed0a18b", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.559Z", "created_at": "2026-09-26T02:40:40.951Z", "modified": "2026-09-26T02:40:41.281Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:41.281Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_id": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_name": null, "from_type": "Indicator", "id": "06ac7d64-2583-4158-b83c-4433dc8fcc78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--34ac30b4-7ddd-5af1-a123-8d3f5dc0142e", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.798Z", "created_at": "2026-09-26T02:22:38.476Z", "modified": "2026-09-26T02:22:38.812Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:38.812Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_id": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_name": null, "from_type": "Indicator", "id": "07c87d0e-b228-46ce-8d64-9b272c873813", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a660579d-1f54-5247-9809-1116e3883526", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.156Z", "created_at": "2026-09-26T02:29:51.514Z", "modified": "2026-09-26T02:29:52.171Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:52.171Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_id": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_name": null, "from_type": "Indicator", "id": "07cdf695-8869-4249-9567-835d968c5567", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--75edab5a-7fb9-5002-98ce-dacf320e4df4", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.736Z", "created_at": "2026-09-26T02:22:23.303Z", "modified": "2026-09-26T02:22:23.858Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:23.858Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_id": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_name": null, "from_type": "Indicator", "id": "083aac97-63e0-4b90-bd41-2890e1505ef1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--543ef891-702e-567b-9812-548e7c6e391e", "toId": "15790dd0-fbaa-432f-b85a-408a7f4cae7a", "to_id": "15790dd0-fbaa-432f-b85a-408a7f4cae7a", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.493Z", "created_at": "2026-09-26T02:39:11.660Z", "modified": "2026-09-26T02:39:11.836Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:11.836Z" }, "description_available": false, "entity_type": "indicates", "fromId": "39347496-5229-494f-9602-405597e9e186", "from_id": "39347496-5229-494f-9602-405597e9e186", "from_name": null, "from_type": "Indicator", "id": "0904ad3e-1d55-48e3-8a1d-f08704a436dd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--083d7934-a5bb-5749-b670-f592db2b0c92", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.928Z", "created_at": "2026-09-26T02:27:11.911Z", "modified": "2026-09-26T02:27:12.298Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:12.298Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_id": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_name": null, "from_type": "Indicator", "id": "0994ab3c-bfae-46f8-86a6-d4e0ec8b995d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--033dbc53-609a-503a-8562-d0bda96f603c", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:15:17.101Z", "created_at": "2026-03-08T08:04:48.602Z", "modified": "2026-03-08T08:04:48.974Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-08T08:04:48.974Z" }, "description_available": false, "entity_type": "targets", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "0a20411f-096d-4069-9ce0-dfad614ea9d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--251f8eb4-a33d-5ab8-8e07-7a36fb5a2a5d", "toId": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_name": "Manufacturing", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.312Z", "created_at": "2026-09-26T02:34:44.800Z", "modified": "2026-09-26T02:34:44.951Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:44.951Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_id": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_name": null, "from_type": "Indicator", "id": "0a2d9402-65f7-412f-8ac1-cd6c1a015964", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a482e5c3-6379-597e-a806-75206d18fd7a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.872Z", "created_at": "2026-09-26T02:25:15.593Z", "modified": "2026-09-26T02:25:21.805Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:25:21.805Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_id": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_name": null, "from_type": "Indicator", "id": "0aac9c18-d7a2-49a9-94f8-cff5290c43e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d01fc204-72b2-5c1f-8e03-b2f28f604137", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.791Z", "created_at": "2026-09-26T02:49:17.802Z", "modified": "2026-09-26T02:49:18.274Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:49:18.274Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_id": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_name": null, "from_type": "Indicator", "id": "0b61b8fa-8317-42a2-b678-34da3943008b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1dc8071d-ce74-5f57-ad08-cb83f3395622", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.925Z", "created_at": "2026-09-26T02:54:12.892Z", "modified": "2026-09-26T02:54:13.096Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:13.096Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_id": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_name": null, "from_type": "Indicator", "id": "0c65a8fe-d6cd-4bea-971b-df51c7261fa0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--145faf06-4702-59d1-8d89-d5279fab401f", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.506Z", "created_at": "2026-09-26T02:39:30.708Z", "modified": "2026-09-26T02:39:30.900Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:30.900Z" }, "description_available": false, "entity_type": "indicates", "fromId": "21107844-453c-4c82-8366-9715c47845ee", "from_id": "21107844-453c-4c82-8366-9715c47845ee", "from_name": null, "from_type": "Indicator", "id": "0d2a8fb5-235c-4053-9612-17f7a380430a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d3650853-69e1-5519-8e6d-cd70e4b7d055", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.299Z", "created_at": "2026-09-26T02:34:23.219Z", "modified": "2026-09-26T02:34:23.575Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:23.575Z" }, "description_available": false, "entity_type": "indicates", "fromId": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_id": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_name": null, "from_type": "Indicator", "id": "0db6d95a-e0bc-4a8b-8f58-78d9318b46cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--50746346-046c-5258-a56d-b4a7ef8b7345", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.997Z", "created_at": "2026-09-26T02:55:23.454Z", "modified": "2026-09-26T02:55:23.796Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:23.796Z" }, "description_available": false, "entity_type": "indicates", "fromId": "78758893-b8ff-478a-87c7-db3374492f48", "from_id": "78758893-b8ff-478a-87c7-db3374492f48", "from_name": null, "from_type": "Indicator", "id": "0f346c79-3ae7-49b7-8673-91512d4087bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--db919de3-f994-5d5d-b149-45dc10a21230", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.784Z", "created_at": "2026-09-26T02:22:31.881Z", "modified": "2026-09-26T02:22:32.893Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:32.893Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_id": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_name": null, "from_type": "Indicator", "id": "0f85db64-0a84-42c5-bcf7-1c297761bc76", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7b999997-87d4-544a-889c-48f3a71a4cd5", "toId": "96641aba-b03d-47c0-b0f0-18d45e9ff5bb", "to_id": "96641aba-b03d-47c0-b0f0-18d45e9ff5bb", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.778Z", "created_at": "2026-09-26T02:22:30.986Z", "modified": "2026-09-26T02:22:31.490Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:31.490Z" }, "description_available": false, "entity_type": "based-on", "fromId": "59d5d604-dce0-4819-9e20-9483824295de", "from_id": "59d5d604-dce0-4819-9e20-9483824295de", "from_name": null, "from_type": "Indicator", "id": "10752d13-c203-4e44-a6ac-2d57c744f425", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8e0fc943-51c4-5f07-a74e-de2e590cbfa8", "toId": "8b0a11b5-658b-4e90-a723-9a28f1aebb03", "to_id": "8b0a11b5-658b-4e90-a723-9a28f1aebb03", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.923Z", "created_at": "2026-09-26T02:54:10.849Z", "modified": "2026-09-26T02:54:12.167Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:12.167Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_id": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_name": null, "from_type": "Indicator", "id": "10b16680-2930-4923-935a-8d96935a856d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--368fe10f-ba5f-5db6-ac44-106a597b2a56", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.328Z", "created_at": "2026-09-26T02:35:13.987Z", "modified": "2026-09-26T02:35:14.207Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:14.207Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_id": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_name": null, "from_type": "Indicator", "id": "113e41f4-cf34-4b37-bcfe-7562ac72945b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2ce01c5e-20fa-5837-a9be-5d1c9dccf118", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.171Z", "created_at": "2026-09-26T02:30:13.185Z", "modified": "2026-09-26T02:30:13.776Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:13.776Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_id": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_name": null, "from_type": "Indicator", "id": "1355ac7e-fa9e-42b4-9067-1d03b85a61e3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fb82b1f1-0ebb-53c0-b5c6-019e904fada6", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.600Z", "created_at": "2026-09-26T02:21:52.002Z", "modified": "2026-09-26T02:21:52.510Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:52.510Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_id": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_name": null, "from_type": "Indicator", "id": "1461c5bf-dd37-4bdd-977d-c3a6ec775faa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--eec766d7-cac0-5004-9c43-8265c88f9137", "toId": "99baaaa1-f038-4240-aa79-0ad013198c94", "to_id": "99baaaa1-f038-4240-aa79-0ad013198c94", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.768Z", "created_at": "2026-09-26T02:22:29.622Z", "modified": "2026-09-26T02:22:30.143Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:30.143Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_id": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_name": null, "from_type": "Indicator", "id": "15ec97cf-e23a-48cb-8cf9-a45d7843cdb2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--29def587-d037-5384-8854-59db5e2fe210", "toId": "00827ecb-07b5-4717-9f4e-29cbfced6eb8", "to_id": "00827ecb-07b5-4717-9f4e-29cbfced6eb8", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.188Z", "created_at": "2026-09-26T02:30:31.139Z", "modified": "2026-09-26T02:30:31.653Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:31.653Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_id": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_name": null, "from_type": "Indicator", "id": "17f7c314-b7ee-420b-98ac-23c5ec03a721", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1de37d25-fc9f-5727-83f2-68bf079ab76b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.421Z", "created_at": "2026-09-26T02:36:29.678Z", "modified": "2026-09-26T02:36:30.039Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:30.039Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_id": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_name": null, "from_type": "Indicator", "id": "1b0c2e6c-f38f-4c71-a432-45365345181f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fa9d3ee6-500b-5e69-b321-535388c7f95a", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.902Z", "created_at": "2026-09-26T02:26:44.497Z", "modified": "2026-09-26T02:26:44.647Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:44.647Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_id": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_name": null, "from_type": "Indicator", "id": "1b27fd00-f351-4893-8d76-7f8144c569b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--90965fd9-d131-5eb3-b82a-1d7faee06017", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.818Z", "created_at": "2026-09-26T02:50:32.775Z", "modified": "2026-09-26T02:50:33.343Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:50:33.343Z" }, "description_available": false, "entity_type": "indicates", "fromId": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_id": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_name": null, "from_type": "Indicator", "id": "1b8581aa-ec89-41c7-a587-f59707a7f419", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e8a33907-009e-5bd0-a048-f05496643c63", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.873Z", "created_at": "2026-09-26T02:53:29.264Z", "modified": "2026-09-26T02:53:29.394Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:29.394Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_id": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_name": null, "from_type": "Indicator", "id": "1bce2af1-378e-4460-8698-f6fba00b99c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d48f440e-e7d6-53b4-be10-bf21ba7d7016", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.420Z", "created_at": "2026-09-26T02:36:27.281Z", "modified": "2026-09-26T02:36:27.507Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:27.507Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_id": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_name": null, "from_type": "Indicator", "id": "2014ae39-05dc-4ab8-9d14-e997278cb6b9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bd1490cb-0828-52c4-ac1e-61c80cb3aab1", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.552Z", "created_at": "2026-09-26T02:17:15.185Z", "modified": "2026-09-26T02:17:15.805Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:15.805Z" }, "description_available": false, "entity_type": "targets", "fromId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_name": "BlueMoon", "from_type": "Malware", "id": "2056f6ae-83c8-424e-b3ab-5374c3b4dde6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--abaa0b49-70c4-53c9-84ae-646c3e12008d", "toId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_name": "Non-Governmental Organizations (NGOs)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.468Z", "created_at": "2026-09-26T02:37:28.694Z", "modified": "2026-09-26T02:37:28.917Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:28.917Z" }, "description_available": false, "entity_type": "indicates", "fromId": "35638839-e7f8-400f-b53f-151f43a9747e", "from_id": "35638839-e7f8-400f-b53f-151f43a9747e", "from_name": null, "from_type": "Indicator", "id": "20e05365-f4ab-486b-8cbf-c920df0044a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--49c0307d-529b-5daa-9b1e-7661f7dc0b7e", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.855Z", "created_at": "2026-09-26T02:23:56.740Z", "modified": "2026-09-26T02:23:56.926Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:56.926Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_id": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_name": null, "from_type": "Indicator", "id": "216def06-2746-4652-a245-2d6b42fefa65", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b1c8c1dc-b535-577c-bf1f-4aaa0992c2a6", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.624Z", "created_at": "2026-09-26T02:41:47.964Z", "modified": "2026-09-26T02:41:48.116Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:48.116Z" }, "description_available": false, "entity_type": "indicates", "fromId": "acd924c0-2829-463e-a00a-14a40a617329", "from_id": "acd924c0-2829-463e-a00a-14a40a617329", "from_name": null, "from_type": "Indicator", "id": "233a4e2f-559e-4f24-9dda-24c294c5abdc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--aaf52009-a5c3-5c9c-9ccc-a378b75b881c", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.360Z", "created_at": "2026-09-26T02:35:28.629Z", "modified": "2026-09-26T02:35:28.813Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:28.813Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_id": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_name": null, "from_type": "Indicator", "id": "240ebd11-8f4a-45bd-8eec-f1c3f2efb422", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6ffc082a-7ac6-5aaa-8ec6-d40a5b99cd84", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.886Z", "created_at": "2026-09-26T02:53:41.743Z", "modified": "2026-09-26T02:53:41.996Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:41.996Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_id": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_name": null, "from_type": "Indicator", "id": "24df5b5d-8626-49e9-8d92-d2bc476bb2f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f508a97b-18b2-56e5-9b71-5ee43637ce8b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.554Z", "created_at": "2026-09-26T02:17:29.823Z", "modified": "2026-09-26T02:17:30.703Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:30.703Z" }, "description_available": false, "entity_type": "targets", "fromId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_name": "GemStone", "from_type": "Malware", "id": "25c04117-d3c6-4dc2-b302-70eee2bd1a87", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--ff8f907b-2240-523e-8854-6faf47280044", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.115Z", "created_at": "2026-09-26T02:29:20.696Z", "modified": "2026-09-26T02:29:20.856Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:20.856Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_id": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_name": null, "from_type": "Indicator", "id": "25eb20d1-fbeb-412f-b6fb-b9841733f282", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c1693424-1079-5453-a2b1-8db54f46fc99", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.285Z", "created_at": "2026-09-26T02:34:05.033Z", "modified": "2026-09-26T02:34:07.126Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:07.126Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_id": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_name": null, "from_type": "Indicator", "id": "260c93a9-b02d-4b45-a3db-4e91cb2988c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--308e4b10-f4d4-5dd1-909c-bc61db73d5b9", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.775Z", "created_at": "2026-09-26T02:22:30.708Z", "modified": "2026-09-26T02:22:31.252Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:31.252Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_id": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_name": null, "from_type": "Indicator", "id": "2626284c-9e3c-42b2-9884-815f1c91ba19", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d3259338-6a45-53a4-90af-3f69062fb24f", "toId": "7c3b12bd-7b05-4192-935f-6e71880b3070", "to_id": "7c3b12bd-7b05-4192-935f-6e71880b3070", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.328Z", "created_at": "2026-09-26T02:34:57.375Z", "modified": "2026-09-26T02:34:57.696Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:57.696Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_id": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_name": null, "from_type": "Indicator", "id": "26473a5c-9cac-48b3-9744-8c64a5862614", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--383fcb40-d103-5128-84b4-8d14d427bf35", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.983Z", "created_at": "2026-09-26T02:55:04.657Z", "modified": "2026-09-26T02:55:04.912Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:04.912Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_id": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_name": null, "from_type": "Indicator", "id": "26b3d21f-6bf4-488b-b24e-af7f7c59bcfa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f2e67be2-de93-5325-a83f-270d8eac265a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.558Z", "created_at": "2026-09-26T02:40:42.254Z", "modified": "2026-09-26T02:40:42.481Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:42.481Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_id": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_name": null, "from_type": "Indicator", "id": "26cb7eed-6641-428b-a730-84d41c8e53d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bd477183-2532-50f0-b4f7-954f38d592ff", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.188Z", "created_at": "2026-09-26T02:30:43.859Z", "modified": "2026-09-26T02:30:44.046Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:44.046Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_id": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_name": null, "from_type": "Indicator", "id": "26feecec-db6d-4361-8bea-224d590ac252", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1e62bc64-5ffd-5060-8775-f5038c5c8557", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.392Z", "created_at": "2026-09-26T02:35:56.904Z", "modified": "2026-09-26T02:35:57.343Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:57.343Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bad82237-3d91-4def-8766-61d38b70be49", "from_id": "bad82237-3d91-4def-8766-61d38b70be49", "from_name": null, "from_type": "Indicator", "id": "2727ebd0-e696-4d33-87ca-a3f50c11c3e1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6195edb0-070d-5d34-be17-62f102c6b0f1", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.219Z", "created_at": "2026-09-26T02:31:04.142Z", "modified": "2026-09-26T02:31:04.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:31:04.375Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_id": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_name": null, "from_type": "Indicator", "id": "27d1809d-cbc1-405a-9649-d40a3e3fe107", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6ec4d223-0475-5911-87cc-18ff52b792a7", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.737Z", "created_at": "2026-09-26T02:46:08.880Z", "modified": "2026-09-26T02:46:09.259Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:46:09.259Z" }, "description_available": false, "entity_type": "indicates", "fromId": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_id": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_name": null, "from_type": "Indicator", "id": "27f622f9-8882-4f6e-b454-ef1a619751dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--52d2d380-a8e0-5b8a-a742-edf80e1a3bea", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.042Z", "created_at": "2026-09-26T02:28:42.424Z", "modified": "2026-09-26T02:28:42.540Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:42.540Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_id": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_name": null, "from_type": "Indicator", "id": "2a04eca2-0b9c-4df1-b764-2b56cf0fefd8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c0a28a7d-764b-5a6c-a16d-39f1fe690346", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.675Z", "created_at": "2026-09-26T02:22:11.484Z", "modified": "2026-09-26T02:22:12.010Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:12.010Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_id": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_name": null, "from_type": "Indicator", "id": "2a1fd1f9-1401-4aba-9186-355058042415", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--32c4dc1d-8f06-524f-a97c-57fd775194da", "toId": "68d8a6cb-a0af-427d-8b9d-ea6b86f1023d", "to_id": "68d8a6cb-a0af-427d-8b9d-ea6b86f1023d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.507Z", "created_at": "2026-09-26T02:39:26.902Z", "modified": "2026-09-26T02:39:27.236Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:27.236Z" }, "description_available": false, "entity_type": "indicates", "fromId": "21107844-453c-4c82-8366-9715c47845ee", "from_id": "21107844-453c-4c82-8366-9715c47845ee", "from_name": null, "from_type": "Indicator", "id": "2b03a58a-c6d8-4721-a020-109908fdc4a2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7a1d18a9-9f02-544b-af70-0597800500eb", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.397Z", "created_at": "2026-01-18T14:35:37.137Z", "modified": "2026-01-18T14:35:37.380Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:35:37.380Z" }, "description_available": true, "entity_type": "part-of", "fromId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "from_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "from_name": "Non-Governmental Organizations (NGOs)", "from_type": "Sector", "id": "2b7eec33-dc51-4b8c-a2a6-349d7fae0de9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "part-of", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--aa02dc7b-9a22-5d7f-9e58-bba56b230964", "toId": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "to_id": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "to_name": "Civil society", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.068Z", "created_at": "2026-09-26T02:28:50.749Z", "modified": "2026-09-26T02:28:51.250Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:51.250Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_id": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_name": null, "from_type": "Indicator", "id": "2b85637d-675e-4c0d-82f7-eb5e3743d0f3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5d3bc49c-01e4-5195-980e-8a0111e6837d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.623Z", "created_at": "2026-09-26T02:41:45.007Z", "modified": "2026-09-26T02:41:45.266Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:45.266Z" }, "description_available": false, "entity_type": "indicates", "fromId": "acd924c0-2829-463e-a00a-14a40a617329", "from_id": "acd924c0-2829-463e-a00a-14a40a617329", "from_name": null, "from_type": "Indicator", "id": "2bc1d654-168d-4136-9796-2f35b58f8f75", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2b567b3b-4e82-55ef-8222-dc74b183ba2b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.798Z", "created_at": "2026-09-26T02:22:42.601Z", "modified": "2026-09-26T02:22:42.870Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:42.870Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_id": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_name": null, "from_type": "Indicator", "id": "2c4c6e04-ffd5-4d69-999e-f95680d77b47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--39a42e7e-5aad-5198-99a2-8c4c1c593302", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.961Z", "created_at": "2026-09-26T02:27:45.349Z", "modified": "2026-09-26T02:27:45.605Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:45.605Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_id": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_name": null, "from_type": "Indicator", "id": "2d5c99e1-87a5-42fd-876b-2f9d88e96b09", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--23041ea7-61a8-534c-b22c-68d5b94a2075", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.727Z", "created_at": "2026-09-26T02:22:21.490Z", "modified": "2026-09-26T02:22:21.984Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:21.984Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_id": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_name": null, "from_type": "Indicator", "id": "2d9ca24a-829e-4844-b492-836c24e6368f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--635cc66b-0dc7-5f63-a2c0-225a817a616b", "toId": "40b390b3-3161-426e-8605-046ed49959d5", "to_id": "40b390b3-3161-426e-8605-046ed49959d5", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.392Z", "created_at": "2026-09-26T02:36:01.952Z", "modified": "2026-09-26T02:36:02.150Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:02.150Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bad82237-3d91-4def-8766-61d38b70be49", "from_id": "bad82237-3d91-4def-8766-61d38b70be49", "from_name": null, "from_type": "Indicator", "id": "2e8f8f77-764e-49bb-a6bb-7be7fa6c6ee1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4cf11eec-d1a7-5c70-8d76-89d39614a6f0", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.136Z", "created_at": "2026-09-26T02:29:36.665Z", "modified": "2026-09-26T02:29:37.165Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:37.165Z" }, "description_available": false, "entity_type": "indicates", "fromId": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_id": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_name": null, "from_type": "Indicator", "id": "2f291ff7-df5c-4c09-80b2-0c7c265018b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5ff0566b-dd95-50df-96d4-0aa8efc5be8a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.012Z", "created_at": "2026-09-26T02:28:26.419Z", "modified": "2026-09-26T02:28:26.604Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:26.604Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_id": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_name": null, "from_type": "Indicator", "id": "2f4ceacb-2537-4edc-af97-b0ae55296818", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7198564c-3ead-52b3-b5ab-ce4c091d98a7", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.736Z", "created_at": "2026-09-26T02:46:11.632Z", "modified": "2026-09-26T02:46:11.934Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:46:11.934Z" }, "description_available": false, "entity_type": "indicates", "fromId": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_id": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_name": null, "from_type": "Indicator", "id": "2ff1f7d5-249e-42a7-a6f1-df7645f96073", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1781f99b-9c93-5ac5-a37b-5e9bd0c0988f", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:23:00.352Z", "created_at": "2026-02-06T21:17:35.916Z", "modified": "2026-02-06T21:17:36.276Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-06T21:17:36.276Z" }, "description_available": false, "entity_type": "targets", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "301465e7-f5d0-44ce-9cef-7c4b18133c47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7242d311-05d0-558c-9ed7-ff78ad75326b", "toId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_name": "Air transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.943Z", "created_at": "2026-09-26T02:27:34.711Z", "modified": "2026-09-26T02:27:34.835Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:34.835Z" }, "description_available": false, "entity_type": "indicates", "fromId": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_id": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_name": null, "from_type": "Indicator", "id": "301d79a2-4976-4d97-bab5-07115d026283", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--9c68c244-c45a-57ee-9b6e-3be267860a9d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.298Z", "created_at": "2026-09-26T02:34:25.759Z", "modified": "2026-09-26T02:34:25.956Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:25.956Z" }, "description_available": false, "entity_type": "indicates", "fromId": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_id": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_name": null, "from_type": "Indicator", "id": "30f51657-fd46-4b45-b628-aad577895a4a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5ea70d88-ed76-5f18-86af-081e45a83a2b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.639Z", "created_at": "2026-09-26T02:22:01.282Z", "modified": "2026-09-26T02:22:03.141Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:03.141Z" }, "description_available": false, "entity_type": "based-on", "fromId": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_id": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_name": null, "from_type": "Indicator", "id": "3125f2a3-216c-4c2d-8199-74ac3273c297", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--472b6250-92d7-54a7-b424-0919bb43e365", "toId": "622a3c64-719a-4bf2-a389-817b4c1092d5", "to_id": "622a3c64-719a-4bf2-a389-817b4c1092d5", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.885Z", "created_at": "2026-09-26T02:26:19.952Z", "modified": "2026-09-26T02:26:20.193Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:20.193Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_id": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_name": null, "from_type": "Indicator", "id": "31ad0b07-0fb3-41d4-8cdd-47d438ef902f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2e55de06-9050-545f-b7bd-5973caf6991a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.605Z", "created_at": "2026-09-26T02:21:52.299Z", "modified": "2026-09-26T02:21:52.839Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:52.839Z" }, "description_available": false, "entity_type": "based-on", "fromId": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_id": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_name": null, "from_type": "Indicator", "id": "33f4a474-a232-408e-a7df-5a75bc2ca5c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a6590d19-f036-575f-a129-119e0e07d3a3", "toId": "722948a5-a24a-4935-9d91-4c7d88ed7ee3", "to_id": "722948a5-a24a-4935-9d91-4c7d88ed7ee3", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:04.013Z", "created_at": "2026-09-26T02:55:40.981Z", "modified": "2026-09-26T02:55:41.161Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:41.161Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_id": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_name": null, "from_type": "Indicator", "id": "3452f2db-550c-40dc-a481-dd10bf6d58c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6bf34b40-0f92-5589-89fd-8a6d415a6f04", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.790Z", "created_at": "2026-09-26T02:49:29.677Z", "modified": "2026-09-26T02:49:30.869Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:49:30.869Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_id": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_name": null, "from_type": "Indicator", "id": "346b60e2-9387-4fc9-bfa3-4e51e3c50777", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--76c7d7c5-eee1-5fb4-878e-a6b883d26f05", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.730Z", "created_at": "2026-09-26T02:22:21.783Z", "modified": "2026-09-26T02:22:22.174Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:22.174Z" }, "description_available": false, "entity_type": "based-on", "fromId": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_id": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_name": null, "from_type": "Indicator", "id": "348c67aa-4185-4cb5-b28f-fdf8d4ea88a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d8aa01b3-02f2-5891-a819-258fd6fd8aaf", "toId": "3d665fa0-7683-4e30-8da6-c91cf0f1d680", "to_id": "3d665fa0-7683-4e30-8da6-c91cf0f1d680", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.172Z", "created_at": "2026-09-26T02:30:29.589Z", "modified": "2026-09-26T02:30:29.787Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:29.787Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_id": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_name": null, "from_type": "Indicator", "id": "34b437c5-07ad-41d0-ab48-c70396a8fe85", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--11255396-b300-51c7-9194-e23265034791", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.615Z", "created_at": "2026-09-26T02:21:57.281Z", "modified": "2026-09-26T02:21:57.979Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:57.979Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_id": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_name": null, "from_type": "Indicator", "id": "354bee02-42e2-47e9-8907-5d010293ba26", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--523701d9-7c1e-5344-8c1f-7d2dbb14aeeb", "toId": "8f499bdc-631b-431a-9931-0ba823d160ec", "to_id": "8f499bdc-631b-431a-9931-0ba823d160ec", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.597Z", "created_at": "2026-09-26T02:21:51.276Z", "modified": "2026-09-26T02:21:51.673Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:51.673Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_id": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_name": null, "from_type": "Indicator", "id": "3593e6ab-03cc-4aa4-9b73-da55e0e842f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4656b9a1-d3ce-5a17-882c-b2c62830670d", "toId": "b218769f-9694-4cc8-a2f8-e5102a348bb7", "to_id": "b218769f-9694-4cc8-a2f8-e5102a348bb7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.947Z", "created_at": "2026-09-26T02:54:24.784Z", "modified": "2026-09-26T02:54:25.138Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:25.138Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_id": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_name": null, "from_type": "Indicator", "id": "360f2784-c90c-4c78-8f5c-3b64f1c50a98", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--08cf1d6c-9f47-585b-94ef-bff759b70b14", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.040Z", "created_at": "2026-09-26T02:28:41.028Z", "modified": "2026-09-26T02:28:41.172Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:41.172Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_id": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_name": null, "from_type": "Indicator", "id": "371fc7d8-8e22-4449-b13b-305b8353f023", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--287fbbac-03bb-5d3a-9451-d1d7cdfdb6e8", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.519Z", "created_at": "2026-09-26T02:39:45.964Z", "modified": "2026-09-26T02:39:46.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:46.375Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_id": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_name": null, "from_type": "Indicator", "id": "38f93435-7331-4af7-91bd-d8e76c5f948b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--54ae01c6-0bbf-530f-a2ef-f714c3ad80ce", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.684Z", "created_at": "2026-09-26T02:22:12.533Z", "modified": "2026-09-26T02:22:13.351Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:13.351Z" }, "description_available": false, "entity_type": "based-on", "fromId": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_id": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_name": null, "from_type": "Indicator", "id": "39aa2698-a966-4109-b167-f6c923fcf0e2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6d246b8e-15e9-52b2-9d3c-9982c3f99874", "toId": "884c37e7-7b29-42fc-be3a-ba2d5ddc16e5", "to_id": "884c37e7-7b29-42fc-be3a-ba2d5ddc16e5", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.658Z", "created_at": "2026-09-26T02:42:16.689Z", "modified": "2026-09-26T02:42:17.607Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:17.607Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_id": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_name": null, "from_type": "Indicator", "id": "3a4366b0-309b-4ea9-b769-7fd407ac4958", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c50aa461-2fd8-512a-a82a-c45995568a93", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.671Z", "created_at": "2026-09-26T02:42:32.634Z", "modified": "2026-09-26T02:42:32.873Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:32.873Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_id": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_name": null, "from_type": "Indicator", "id": "3b06ea64-72cf-4bb3-8d97-93bf33fb9685", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--aa5be8f9-f35e-5c92-9ec2-f3880a30cc0a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.831Z", "created_at": "2026-09-26T02:51:35.807Z", "modified": "2026-09-26T02:51:39.304Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:51:39.304Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_id": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_name": null, "from_type": "Indicator", "id": "3d371772-8655-4189-84a9-8fbdc2f423cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--314df536-d47c-5cf9-bab7-2dada976f329", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.872Z", "created_at": "2026-09-26T02:53:30.738Z", "modified": "2026-09-26T02:53:30.953Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:30.953Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_id": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_name": null, "from_type": "Indicator", "id": "3d444fa8-c34a-4f73-98b9-b81526a8832e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--30f55d61-62b8-5461-8545-f0623a70395a", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.764Z", "created_at": "2026-09-26T02:47:40.300Z", "modified": "2026-09-26T02:47:43.013Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:47:43.013Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_id": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_name": null, "from_type": "Indicator", "id": "3d4fd28c-7a74-4f21-aabc-3cdfaa5a1cc6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a5282773-dff0-5997-85a4-995148582d1d", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.273Z", "created_at": "2026-09-26T02:33:49.640Z", "modified": "2026-09-26T02:33:49.842Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:49.842Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_id": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_name": null, "from_type": "Indicator", "id": "3d5df24f-36ea-4fc9-b3da-f1d1c4639ba2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8fbedc49-36b4-5d7e-b4d7-9be99a743e5f", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.612Z", "created_at": "2026-09-26T02:21:54.794Z", "modified": "2026-09-26T02:21:56.822Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:56.822Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_id": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_name": null, "from_type": "Indicator", "id": "3e006d83-18a3-4da2-b0d7-432119317c64", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6a2ba950-c32a-5920-9498-e2cdddc77385", "toId": "08e46069-bd2e-4b5d-8bdc-de5a4ceacf25", "to_id": "08e46069-bd2e-4b5d-8bdc-de5a4ceacf25", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.157Z", "created_at": "2026-09-26T02:29:53.915Z", "modified": "2026-09-26T02:29:54.167Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:54.167Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_id": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_name": null, "from_type": "Indicator", "id": "3e3fc2f4-abbd-4c4c-b0ef-ebd20cf1630d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8e6316a3-6387-5f2f-98fd-516ee4979c6f", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.698Z", "created_at": "2026-09-26T02:43:08.810Z", "modified": "2026-09-26T02:43:09.100Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:43:09.100Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_id": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_name": null, "from_type": "Indicator", "id": "3e7d0d62-d81c-4c29-a52d-f5420e7fed59", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--19cda7c8-265d-5265-822e-14d8e24cc4dd", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.574Z", "created_at": "2026-09-26T02:41:01.178Z", "modified": "2026-09-26T02:41:01.308Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:01.308Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_id": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_name": null, "from_type": "Indicator", "id": "40528c02-d529-406f-91b3-78efe08306a5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e283818d-b302-5a57-a97d-a92adbbc6171", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.732Z", "created_at": "2026-09-26T02:22:23.296Z", "modified": "2026-09-26T02:22:23.859Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:23.859Z" }, "description_available": false, "entity_type": "based-on", "fromId": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_id": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_name": null, "from_type": "Indicator", "id": "41e1cea8-9180-451e-ad71-3c3e03b06840", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d6661b35-2fde-5358-90e8-8d9a455a83d5", "toId": "5f548518-0667-4728-9c44-c960cb03c0ab", "to_id": "5f548518-0667-4728-9c44-c960cb03c0ab", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.657Z", "created_at": "2026-09-26T02:42:16.194Z", "modified": "2026-09-26T02:42:16.376Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:16.376Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_id": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_name": null, "from_type": "Indicator", "id": "41e47465-be1b-4a90-980e-ff9b18923016", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--37c18708-5232-5fc3-a7e7-0138a270b934", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.453Z", "created_at": "2026-09-26T02:37:11.026Z", "modified": "2026-09-26T02:37:11.180Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:11.180Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_id": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_name": null, "from_type": "Indicator", "id": "42377b5b-3aa2-49cb-bfee-945f648b76f4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e8eaffd2-1248-5935-8c07-a3f95052b02d", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.915Z", "created_at": "2026-09-26T02:26:58.626Z", "modified": "2026-09-26T02:26:59.002Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:59.002Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_id": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_name": null, "from_type": "Indicator", "id": "42d7724c-1e8f-44ec-84f6-2a836e30af39", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--94a76c7d-51f9-5cb9-9a1d-54e2b017c21f", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.205Z", "created_at": "2026-09-26T02:30:44.891Z", "modified": "2026-09-26T02:30:45.927Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:45.927Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_id": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_name": null, "from_type": "Indicator", "id": "441b2018-d6ca-4f5f-a498-3b05502dba5b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bec836a7-2af5-5493-a349-f75e23debb1d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.622Z", "created_at": "2026-09-26T02:21:59.874Z", "modified": "2026-09-26T02:22:00.179Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:00.179Z" }, "description_available": false, "entity_type": "based-on", "fromId": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_id": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_name": null, "from_type": "Indicator", "id": "44493e9a-13be-428e-97b9-976f1f4a089e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--929cb06c-6ef3-591c-b54b-4d0170701f29", "toId": "e26f54a6-3647-487e-aa95-721f6796d399", "to_id": "e26f54a6-3647-487e-aa95-721f6796d399", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.636Z", "created_at": "2026-09-26T02:22:01.084Z", "modified": "2026-09-26T02:22:02.567Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:02.567Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_id": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_name": null, "from_type": "Indicator", "id": "4593ac56-a085-4e2d-86b6-c142d47c47a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3fede326-faab-51a0-8f5a-356f4e9b5903", "toId": "8f41ac2c-e916-4724-b010-f9896e16c1fb", "to_id": "8f41ac2c-e916-4724-b010-f9896e16c1fb", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.743Z", "created_at": "2026-09-26T02:22:24.326Z", "modified": "2026-09-26T02:22:24.678Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:24.678Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_id": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_name": null, "from_type": "Indicator", "id": "460d844a-c813-4060-a5cd-7b32a76c1d40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--89a17e1d-1b55-5e4f-b300-350dcae8c176", "toId": "54a4c15c-2a7f-4ec3-a5dc-1fffc1ca9a3c", "to_id": "54a4c15c-2a7f-4ec3-a5dc-1fffc1ca9a3c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.551Z", "created_at": "2026-09-26T02:17:23.631Z", "modified": "2026-09-26T02:17:24.559Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:24.559Z" }, "description_available": false, "entity_type": "targets", "fromId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_name": "BlueMoon", "from_type": "Malware", "id": "46b33ff0-8a79-4b08-a729-6e0663d4adb1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--18c2c9e5-5fb3-57a6-aeca-0fbde790a3f8", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.710Z", "created_at": "2026-09-26T02:43:39.515Z", "modified": "2026-09-26T02:43:39.915Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:43:39.915Z" }, "description_available": false, "entity_type": "indicates", "fromId": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_id": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_name": null, "from_type": "Indicator", "id": "471bf124-cc8f-46ee-b631-10276c296887", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8d3b5e92-c83a-53ed-993f-5beb04d58b7e", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.091Z", "created_at": "2026-09-26T02:29:05.370Z", "modified": "2026-09-26T02:29:05.542Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:05.542Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_id": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_name": null, "from_type": "Indicator", "id": "4814abf1-fb0c-47ef-a470-c5e001527521", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6949121e-acdb-5aa6-b64f-c7c05de81e80", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.632Z", "created_at": "2026-09-26T02:22:00.515Z", "modified": "2026-09-26T02:22:00.821Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:00.821Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_id": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_name": null, "from_type": "Indicator", "id": "48c0eced-2a7f-4b9c-a892-074c8c55094e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--275e338f-3409-5b8d-ba1c-5c3ac80c6177", "toId": "adfde137-8bff-4f27-8c2d-320d0de4f1da", "to_id": "adfde137-8bff-4f27-8c2d-320d0de4f1da", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.781Z", "created_at": "2026-09-26T02:22:31.324Z", "modified": "2026-09-26T02:22:32.486Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:32.486Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_id": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_name": null, "from_type": "Indicator", "id": "49a03d3d-990d-414d-ae50-4974790f90f2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3e632a10-5db7-5b6e-a646-5519eec9606b", "toId": "6f90eb7f-de7b-4cf4-b400-fc7764e46ceb", "to_id": "6f90eb7f-de7b-4cf4-b400-fc7764e46ceb", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:04.012Z", "created_at": "2026-09-26T02:55:52.045Z", "modified": "2026-09-26T02:55:52.255Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:52.255Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_id": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_name": null, "from_type": "Indicator", "id": "4a58625c-4eb9-41ff-b99a-42dbcbc6652d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--ed08fe20-809c-5edd-ac8d-14b31ea5165c", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.608Z", "created_at": "2026-09-26T02:21:53.094Z", "modified": "2026-09-26T02:21:56.062Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:56.062Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_id": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_name": null, "from_type": "Indicator", "id": "4be35748-70b7-47aa-abdd-5f950c7301d6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f38a1732-bbc9-5a17-838d-073a233ae06a", "toId": "bbeffa1c-3e6b-4cf3-b27b-3eece4197be7", "to_id": "bbeffa1c-3e6b-4cf3-b27b-3eece4197be7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.041Z", "created_at": "2026-09-26T02:28:36.834Z", "modified": "2026-09-26T02:28:37.248Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:37.248Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_id": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_name": null, "from_type": "Indicator", "id": "4d85d2a9-6f88-43b5-acf2-a2b038da2f04", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a04cb393-4d91-5a51-ad62-56de87263464", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.231Z", "created_at": "2026-09-26T02:32:46.088Z", "modified": "2026-09-26T02:32:46.390Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:32:46.390Z" }, "description_available": false, "entity_type": "indicates", "fromId": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_id": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_name": null, "from_type": "Indicator", "id": "4dcb0355-4d9f-4c61-8c87-8f8b09d69891", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d73c9e33-3db3-5a08-9822-d35767742912", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.092Z", "created_at": "2026-09-26T02:29:13.364Z", "modified": "2026-09-26T02:29:13.646Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:13.646Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_id": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_name": null, "from_type": "Indicator", "id": "4df2dfd6-fe9b-48f9-bb59-34e1c749a9d5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c621cc8c-53c7-50e8-9980-75a5ccdbc7f4", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.859Z", "created_at": "2026-09-26T02:53:08.537Z", "modified": "2026-09-26T02:53:08.715Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:08.715Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_id": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_name": null, "from_type": "Indicator", "id": "4ec644cd-06e5-4111-9c6a-99d57a25c2dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fac96018-4fa0-5c19-954f-d6b46a742ab4", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.699Z", "created_at": "2026-09-26T02:22:17.973Z", "modified": "2026-09-26T02:22:18.892Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:18.892Z" }, "description_available": false, "entity_type": "based-on", "fromId": "39347496-5229-494f-9602-405597e9e186", "from_id": "39347496-5229-494f-9602-405597e9e186", "from_name": null, "from_type": "Indicator", "id": "515df59b-6815-4c79-ac61-ed8066be301e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--ed2c52c2-fce1-5791-8b29-88f6bebf5f12", "toId": "a782bd25-1b5c-4c7c-8955-fcdc8b283b06", "to_id": "a782bd25-1b5c-4c7c-8955-fcdc8b283b06", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:04.026Z", "created_at": "2026-09-26T02:56:07.090Z", "modified": "2026-09-26T02:56:07.365Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:56:07.365Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_id": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_name": null, "from_type": "Indicator", "id": "53650058-c36d-4902-906a-63e7530c41d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--007ab5cb-be53-5886-a5ba-29a93d84a174", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.832Z", "created_at": "2026-09-26T02:52:15.497Z", "modified": "2026-09-26T02:52:19.617Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:52:19.617Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_id": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_name": null, "from_type": "Indicator", "id": "54dcbfad-c885-4f57-9525-6bfac352480f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bbecaadf-d37f-56a2-8f35-074e96752c23", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.661Z", "created_at": "2026-09-26T02:22:06.851Z", "modified": "2026-09-26T02:22:09.528Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:09.528Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_id": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_name": null, "from_type": "Indicator", "id": "557da1d4-bfd2-4af0-98ea-e3f16490c54b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3a6df042-373f-5aca-95d2-457f92ca6f0f", "toId": "6655b2d3-90b8-48d5-8d24-bd35ee22e55a", "to_id": "6655b2d3-90b8-48d5-8d24-bd35ee22e55a", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:23:00.348Z", "created_at": "2026-02-06T21:17:31.607Z", "modified": "2026-02-06T21:17:31.972Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-06T21:17:31.972Z" }, "description_available": false, "entity_type": "targets", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "559f1071-806c-40f0-9eb2-5579add3e41a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--477598f2-3a35-5e00-88ad-362ac94a1a13", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.067Z", "created_at": "2026-09-26T02:28:51.509Z", "modified": "2026-09-26T02:28:51.715Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:51.715Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_id": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_name": null, "from_type": "Indicator", "id": "5617dfc5-83c2-47f9-aebc-2be660522079", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1ca5f74c-809a-5eba-977f-9531675be4d9", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.285Z", "created_at": "2026-09-26T02:34:14.774Z", "modified": "2026-09-26T02:34:14.913Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:14.913Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_id": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_name": null, "from_type": "Indicator", "id": "5761ca2e-085a-4de0-b5f0-50de11eb4860", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--72e36fda-a63c-5046-a272-3f7f8e0489ab", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.901Z", "created_at": "2026-09-26T02:26:42.928Z", "modified": "2026-09-26T02:26:43.179Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:43.179Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_id": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_name": null, "from_type": "Indicator", "id": "58a8cd71-d960-44b8-b68b-307fd94cac0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bbbc0730-3aa3-596c-8bbf-3f4743e61372", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.914Z", "created_at": "2026-09-26T02:26:57.512Z", "modified": "2026-09-26T02:26:58.067Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:58.067Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_id": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_name": null, "from_type": "Indicator", "id": "58c97451-72df-4405-a0ab-b2803a10f29d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a9dd8bb2-8fb2-59b3-8a43-c346c8969c95", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.901Z", "created_at": "2026-09-26T02:26:43.457Z", "modified": "2026-09-26T02:26:43.658Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:43.658Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_id": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_name": null, "from_type": "Indicator", "id": "58f04776-0147-43cc-b0f2-acd4707c410e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fe1db646-756c-5a72-a170-58ba5658f188", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.566Z", "created_at": "2026-09-26T02:21:14.660Z", "modified": "2026-09-26T02:21:16.465Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:16.465Z" }, "description_available": false, "entity_type": "targets", "fromId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_name": "GemStone", "from_type": "Malware", "id": "59a0700d-29ad-4c92-9ee4-53cdba153f40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--febdbfc2-713b-5274-9c04-9b6864f45e12", "toId": "4458b114-0fe4-4d79-beea-3b281c045e08", "to_id": "4458b114-0fe4-4d79-beea-3b281c045e08", "to_name": "CVE-2026-85880", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.066Z", "created_at": "2026-09-26T02:28:47.978Z", "modified": "2026-09-26T02:28:48.115Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:48.115Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_id": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "from_name": null, "from_type": "Indicator", "id": "59faf739-07b3-4838-aa17-c2c8256ed65d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fdc9f82a-198d-583c-a81e-e23509d6c1c6", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.845Z", "created_at": "2026-09-26T02:52:47.885Z", "modified": "2026-09-26T02:52:49.038Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:52:49.038Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_id": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_name": null, "from_type": "Indicator", "id": "5be20377-e74d-402c-9871-f25401c7130b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--9ea5f210-2f84-5a96-a111-2efbf26bdf8a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.684Z", "created_at": "2026-09-26T02:42:59.833Z", "modified": "2026-09-26T02:43:00.115Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:43:00.115Z" }, "description_available": false, "entity_type": "indicates", "fromId": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_id": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_name": null, "from_type": "Indicator", "id": "5c356cde-9160-42a2-b063-7a0eda366ac1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--288ecbeb-4522-5bf3-baab-2a5bf2e3349b", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.667Z", "created_at": "2026-09-26T02:22:10.945Z", "modified": "2026-09-26T02:22:11.198Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:11.198Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_id": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_name": null, "from_type": "Indicator", "id": "5c7a587f-c6f1-4bea-b605-2496c42fdb93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b24a27c6-7ed0-5066-b251-877be14c58ef", "toId": "4df2990c-e4dc-457c-9dad-4f8d2a2cb427", "to_id": "4df2990c-e4dc-457c-9dad-4f8d2a2cb427", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.272Z", "created_at": "2026-09-26T02:33:46.827Z", "modified": "2026-09-26T02:33:47.049Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:47.049Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_id": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_name": null, "from_type": "Indicator", "id": "5cb7ab19-fef9-4b06-8a4e-f2f6e8d264fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1a063ef0-fbbd-5950-a1ed-c91e527c7b9b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.786Z", "created_at": "2026-09-26T02:22:32.548Z", "modified": "2026-09-26T02:22:33.230Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:33.230Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_id": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_name": null, "from_type": "Indicator", "id": "5d21c328-ee6e-48ba-ac82-c7fd10a8a297", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--36e17404-c117-5449-a39f-f731c7f763e5", "toId": "4d0e460f-4bbe-433e-a324-fc8500e89552", "to_id": "4d0e460f-4bbe-433e-a324-fc8500e89552", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.924Z", "created_at": "2026-09-26T02:54:13.922Z", "modified": "2026-09-26T02:54:14.154Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:14.154Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_id": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "from_name": null, "from_type": "Indicator", "id": "5da92a0a-a482-4379-86e6-edb9be81c1b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--32217846-f7bc-5818-b7a9-3e139dd2fefc", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.712Z", "created_at": "2026-09-26T02:22:20.051Z", "modified": "2026-09-26T02:22:20.298Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:20.298Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_id": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_name": null, "from_type": "Indicator", "id": "5e66d34a-b5f0-4564-bb49-9e14ea8e5f26", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d8764bdf-8c01-5319-aa4f-573413dc104d", "toId": "b755ca83-8714-4ce4-8dd2-5907570a1461", "to_id": "b755ca83-8714-4ce4-8dd2-5907570a1461", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.841Z", "created_at": "2026-09-26T02:23:35.450Z", "modified": "2026-09-26T02:23:38.197Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:38.197Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_id": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_name": null, "from_type": "Indicator", "id": "5ea7b4a5-bc46-43f6-9231-a0cf232d92a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7a8be2e9-9b08-533a-99d8-6d65342b583c", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.770Z", "created_at": "2026-09-26T02:22:29.794Z", "modified": "2026-09-26T02:22:30.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:30.352Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_id": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_name": null, "from_type": "Indicator", "id": "5edc55b5-55a0-4fe3-91ee-7f0499fc99a2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--aab41259-e9c1-592b-8bd0-987b281d42a0", "toId": "cc521352-21dd-488f-bbf6-9b20ac1d1a26", "to_id": "cc521352-21dd-488f-bbf6-9b20ac1d1a26", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.247Z", "created_at": "2026-09-26T02:33:09.688Z", "modified": "2026-09-26T02:33:10.078Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:10.078Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_id": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_name": null, "from_type": "Indicator", "id": "5f8a5a98-e782-41ef-a00b-3c8a1b7d1a45", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--ff3928df-80cd-5bf0-b6a7-8a34179e2664", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.608Z", "created_at": "2026-09-26T02:41:29.232Z", "modified": "2026-09-26T02:41:29.438Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:29.438Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_id": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_name": null, "from_type": "Indicator", "id": "5fc495ab-76ee-442f-9304-f709dfc14c3b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2551c36d-6c9d-533e-a84b-99cdeaf91e33", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.559Z", "created_at": "2026-09-26T02:40:45.246Z", "modified": "2026-09-26T02:40:45.422Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:45.422Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_id": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "from_name": null, "from_type": "Indicator", "id": "60926bab-d5c7-4051-a38c-2065cfe301fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--129f1110-1d26-5b4d-8a06-69a3b14291da", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.697Z", "created_at": "2026-09-26T02:22:16.738Z", "modified": "2026-09-26T02:22:18.890Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:18.890Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_id": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_name": null, "from_type": "Indicator", "id": "60ebb681-fa29-4c0a-8737-b286212b9d01", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7a4b6b20-c36b-55d8-8b1f-1f5700fe3433", "toId": "c710d1c7-ba63-4ec5-b172-443637ee9022", "to_id": "c710d1c7-ba63-4ec5-b172-443637ee9022", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.627Z", "created_at": "2026-09-26T02:21:59.885Z", "modified": "2026-09-26T02:22:00.178Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:00.178Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_id": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_name": null, "from_type": "Indicator", "id": "6186f762-dd17-4cf5-8174-d5b15d5dcb6a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--616dc115-fbdb-5dc8-a6fd-8d0fa7b6d0ee", "toId": "fbb098b4-67dc-4979-8650-344c43ffd62a", "to_id": "fbb098b4-67dc-4979-8650-344c43ffd62a", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:04.013Z", "created_at": "2026-09-26T02:55:39.993Z", "modified": "2026-09-26T02:55:40.726Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:40.726Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_id": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_name": null, "from_type": "Indicator", "id": "624f4d43-ffe5-45b4-a4cc-3769875171d0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b786178d-beea-5574-abb0-5186542ac58b", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.232Z", "created_at": "2026-09-26T02:32:46.820Z", "modified": "2026-09-26T02:32:47.168Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:32:47.168Z" }, "description_available": false, "entity_type": "indicates", "fromId": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_id": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_name": null, "from_type": "Indicator", "id": "628940ab-e1c9-4648-b950-f02cf6641291", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3ebc85ef-3e17-504c-b8b8-c08201c69e85", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.553Z", "created_at": "2026-09-26T02:17:17.587Z", "modified": "2026-09-26T02:17:18.409Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:18.409Z" }, "description_available": false, "entity_type": "targets", "fromId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_name": "BlueMoon", "from_type": "Malware", "id": "641ed173-d9e4-407e-924b-9156e9ee09ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7f18c1a6-81f2-5e13-8c3e-ba856261b9c4", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.872Z", "created_at": "2026-09-26T02:53:28.418Z", "modified": "2026-09-26T02:53:28.726Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:28.726Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_id": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_name": null, "from_type": "Indicator", "id": "668729be-79de-46a6-9400-66920cce6eb4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e8f322d5-095f-5e24-9a93-38ef70ce70da", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.797Z", "created_at": "2026-09-26T02:22:46.931Z", "modified": "2026-09-26T02:22:47.162Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:47.162Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_id": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_name": null, "from_type": "Indicator", "id": "6845ed85-8e07-427f-9cd5-410a21a61aaa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4dae5d04-45f8-5311-8878-9fe151c687aa", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.756Z", "created_at": "2026-09-26T02:22:25.252Z", "modified": "2026-09-26T02:22:27.462Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:27.462Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_id": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_name": null, "from_type": "Indicator", "id": "69aa98d9-e549-4bcb-8089-016cab3fd7b6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--dcba055f-c893-582c-8fba-420c4614cb12", "toId": "27220f9c-2118-42fb-b51c-a7a79a25e15e", "to_id": "27220f9c-2118-42fb-b51c-a7a79a25e15e", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.493Z", "created_at": "2026-09-26T02:39:06.590Z", "modified": "2026-09-26T02:39:06.761Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:06.761Z" }, "description_available": false, "entity_type": "indicates", "fromId": "39347496-5229-494f-9602-405597e9e186", "from_id": "39347496-5229-494f-9602-405597e9e186", "from_name": null, "from_type": "Indicator", "id": "69b5b5a0-9c03-4d00-8488-b4de664fc366", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5d3bf368-541e-5224-8216-f893738329d8", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.691Z", "created_at": "2026-09-26T02:22:13.971Z", "modified": "2026-09-26T02:22:14.478Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:14.478Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_id": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_name": null, "from_type": "Indicator", "id": "6a3241b5-b28e-4714-a125-ee4e2d9ce793", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--31f262ce-0535-5fc1-96e6-e8707f89553e", "toId": "93b015db-4a70-4d9b-b462-a41b1aeb0c54", "to_id": "93b015db-4a70-4d9b-b462-a41b1aeb0c54", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.929Z", "created_at": "2026-09-26T02:27:12.946Z", "modified": "2026-09-26T02:27:15.123Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:15.123Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_id": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_name": null, "from_type": "Indicator", "id": "6a417abd-5b3e-43a1-ba62-1efa5dde1647", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c1f26eba-f695-5f10-9009-4af283a7cf69", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.900Z", "created_at": "2026-09-26T02:53:53.099Z", "modified": "2026-09-26T02:53:53.322Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:53.322Z" }, "description_available": false, "entity_type": "indicates", "fromId": "59d5d604-dce0-4819-9e20-9483824295de", "from_id": "59d5d604-dce0-4819-9e20-9483824295de", "from_name": null, "from_type": "Indicator", "id": "6a5a5b24-7f7e-450e-8223-1c2dba1419de", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e2ee7485-0288-543b-913f-2353bd621f4f", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.647Z", "created_at": "2026-09-26T02:22:03.731Z", "modified": "2026-09-26T02:22:04.363Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:04.363Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_id": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_name": null, "from_type": "Indicator", "id": "6b6e644a-2e09-41ca-9987-e13934033eb6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e5eadddb-3274-5e82-ad09-22d8899565b9", "toId": "406be21b-1340-4a85-ae2c-f95f004e46a7", "to_id": "406be21b-1340-4a85-ae2c-f95f004e46a7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.670Z", "created_at": "2026-09-26T02:42:31.540Z", "modified": "2026-09-26T02:42:31.777Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:31.777Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_id": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_name": null, "from_type": "Indicator", "id": "6cf7e307-4e60-4b14-a9d5-4b3287151823", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fcd312ff-2056-54c4-99a1-df90348e5296", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.748Z", "created_at": "2026-09-26T02:22:24.549Z", "modified": "2026-09-26T02:22:24.910Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:24.910Z" }, "description_available": false, "entity_type": "based-on", "fromId": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_id": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_name": null, "from_type": "Indicator", "id": "6d143f96-0052-4578-b073-a21e4f48b6d5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1e255ceb-9906-5558-a19f-36b1888fd139", "toId": "127bcbba-f38a-49c8-890c-c734acc14afb", "to_id": "127bcbba-f38a-49c8-890c-c734acc14afb", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.740Z", "created_at": "2026-09-26T02:22:23.620Z", "modified": "2026-09-26T02:22:24.015Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:24.015Z" }, "description_available": false, "entity_type": "based-on", "fromId": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_id": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_name": null, "from_type": "Indicator", "id": "6de16293-8c1b-4c0c-b4f1-03f153910b0f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--03723d49-647a-5d1f-8b65-c3185e953544", "toId": "17305616-ea7d-46c7-b74d-756e1d528ebe", "to_id": "17305616-ea7d-46c7-b74d-756e1d528ebe", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.678Z", "created_at": "2026-09-26T02:22:12.235Z", "modified": "2026-09-26T02:22:12.674Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:12.674Z" }, "description_available": false, "entity_type": "based-on", "fromId": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_id": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_name": null, "from_type": "Indicator", "id": "6e5425e6-5f89-4f9e-a8d3-8906a08852e3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fd0e2da4-1482-531c-8cac-313fb054451b", "toId": "cf3f2241-a684-4462-90e6-a7be1d592547", "to_id": "cf3f2241-a684-4462-90e6-a7be1d592547", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.651Z", "created_at": "2026-09-26T02:22:04.697Z", "modified": "2026-09-26T02:22:05.977Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:05.977Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_id": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_name": null, "from_type": "Indicator", "id": "6eb2f8a6-2fca-40c3-b35f-e1c754ba3601", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7de7ab7a-c684-5964-86e5-cf17ea274ba4", "toId": "147f5db3-4484-4f3c-867b-970c8d6fb979", "to_id": "147f5db3-4484-4f3c-867b-970c8d6fb979", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.860Z", "created_at": "2026-09-26T02:53:08.995Z", "modified": "2026-09-26T02:53:09.193Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:09.193Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_id": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_name": null, "from_type": "Indicator", "id": "71a27e50-18ea-4157-b47b-3c9a0f5e0561", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--af4e7678-4a7c-5537-85c4-84a2c2a34bb5", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.494Z", "created_at": "2026-09-26T02:39:07.106Z", "modified": "2026-09-26T02:39:07.412Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:07.412Z" }, "description_available": false, "entity_type": "indicates", "fromId": "39347496-5229-494f-9602-405597e9e186", "from_id": "39347496-5229-494f-9602-405597e9e186", "from_name": null, "from_type": "Indicator", "id": "71cfd3c6-7056-4c82-85c2-0da9c2e81ece", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--175f2e6f-8d45-53fe-a58f-7f575385eec8", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.609Z", "created_at": "2026-09-26T02:41:27.680Z", "modified": "2026-09-26T02:41:27.947Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:27.947Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_id": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_name": null, "from_type": "Indicator", "id": "7266405c-ef90-4130-8800-34dbcda9a4c1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f3e8bcd7-1363-59f0-84fa-7d94e20f7a15", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.724Z", "created_at": "2026-09-26T02:45:44.606Z", "modified": "2026-09-26T02:45:46.162Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:45:46.162Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_id": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_name": null, "from_type": "Indicator", "id": "754a9f69-c8ca-4c6d-8d94-228d4b7187c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b05ad720-d897-5499-b1b6-34efba44dc89", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.871Z", "created_at": "2026-09-26T02:26:09.470Z", "modified": "2026-09-26T02:26:09.677Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:09.677Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_id": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_name": null, "from_type": "Indicator", "id": "75661e25-1136-4fad-923a-6af629cd7076", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1a79ab93-14f0-5f17-85ce-b3815c8f1828", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.556Z", "created_at": "2026-09-26T02:17:23.960Z", "modified": "2026-09-26T02:17:26.147Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:26.147Z" }, "description_available": false, "entity_type": "targets", "fromId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_name": "GemStone", "from_type": "Malware", "id": "75e7a14c-d54a-4987-9977-82e0e5e65687", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f58757de-62c3-5743-9349-31fcc1c88cea", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.406Z", "created_at": "2026-09-26T02:36:20.365Z", "modified": "2026-09-26T02:36:20.603Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:20.603Z" }, "description_available": false, "entity_type": "indicates", "fromId": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_id": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_name": null, "from_type": "Indicator", "id": "75e8f033-6293-43d1-98b4-5b51d526d8a1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--46e213a2-18d3-5f9a-94b5-d5414bcb5bb4", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.827Z", "created_at": "2026-09-26T02:23:22.152Z", "modified": "2026-09-26T02:23:22.502Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:22.502Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_id": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_name": null, "from_type": "Indicator", "id": "7669902a-c07c-4a96-b4c3-ebd1856d1fde", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--12b7ba5a-37d7-57c7-ad19-aa9171d8fbae", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.345Z", "created_at": "2026-09-26T02:35:15.543Z", "modified": "2026-09-26T02:35:15.691Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:15.691Z" }, "description_available": false, "entity_type": "indicates", "fromId": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_id": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_name": null, "from_type": "Indicator", "id": "7675d28f-115a-4256-b619-f31b943f7214", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--71d07bda-a61c-5f79-98c3-cd1c565c5002", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.750Z", "created_at": "2026-09-26T02:46:35.574Z", "modified": "2026-09-26T02:46:35.894Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:46:35.894Z" }, "description_available": false, "entity_type": "indicates", "fromId": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_id": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_name": null, "from_type": "Indicator", "id": "78573959-545b-4a8e-80c1-82b5c05dae4f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f9baf579-3ae0-59ed-a4de-72c5442944d7", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.634Z", "created_at": "2026-09-26T02:22:00.517Z", "modified": "2026-09-26T02:22:00.822Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:00.822Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_id": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_name": null, "from_type": "Indicator", "id": "78f6740b-409d-4344-9cb1-e423532311fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d2c53dac-b1c5-50c5-93b7-37de2931d23d", "toId": "aa2428da-1698-4a7d-a12e-45989e024aeb", "to_id": "aa2428da-1698-4a7d-a12e-45989e024aeb", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.751Z", "created_at": "2026-09-26T02:22:25.151Z", "modified": "2026-09-26T02:22:25.867Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:25.867Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_id": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_name": null, "from_type": "Indicator", "id": "79218547-1dcd-4a1d-a7b6-dff9629f1e90", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--448d8d6e-daa1-54a0-9e22-3ec243e5f776", "toId": "5e10a076-cfa4-406c-b414-239ab3d85b3a", "to_id": "5e10a076-cfa4-406c-b414-239ab3d85b3a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.697Z", "created_at": "2026-09-26T02:43:06.700Z", "modified": "2026-09-26T02:43:06.890Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:43:06.890Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_id": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_name": null, "from_type": "Indicator", "id": "7ac10d9b-a5a9-49d9-bb1a-d65d08398f77", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--85022c2c-279d-5d13-90dd-2b982f44b2db", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.827Z", "created_at": "2026-09-26T02:23:17.341Z", "modified": "2026-09-26T02:23:17.531Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:17.531Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_id": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_name": null, "from_type": "Indicator", "id": "7ae2c90f-1b0c-4ac3-ae90-dccd8df401d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--286347db-cba3-5f50-9f46-3b21ba1d45dd", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.641Z", "created_at": "2026-09-26T02:22:01.285Z", "modified": "2026-09-26T02:22:03.143Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:03.143Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_id": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_name": null, "from_type": "Indicator", "id": "7c0b9e38-4ce2-4f13-a3ff-159ffa48f631", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--79af338d-fd52-531d-91be-028870bf56db", "toId": "95d05541-4dfd-417b-9938-afe603a48f2a", "to_id": "95d05541-4dfd-417b-9938-afe603a48f2a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:04.026Z", "created_at": "2026-09-26T02:55:56.328Z", "modified": "2026-09-26T02:55:56.497Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:56.497Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_id": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_name": null, "from_type": "Indicator", "id": "7c2afa8f-35c5-4f90-b837-360bf0d44fcd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2775d988-1209-58f8-89c6-aeed2a7d0a28", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.555Z", "created_at": "2026-09-26T02:17:20.876Z", "modified": "2026-09-26T02:17:22.966Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:22.966Z" }, "description_available": false, "entity_type": "targets", "fromId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_name": "GemStone", "from_type": "Malware", "id": "7ce9c757-2b57-4716-a794-2150d1aa575d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--30ba3f2f-9c54-5b1e-9790-f882f00dd363", "toId": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_name": "Manufacturing", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.697Z", "created_at": "2026-09-26T02:43:05.853Z", "modified": "2026-09-26T02:43:06.155Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:43:06.155Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_id": "a2ce0dd7-6c53-42e7-8e04-3d6e337d093a", "from_name": null, "from_type": "Indicator", "id": "7d23efe7-a425-42b1-bf20-b4eaaf0a0a4f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f789c59c-7998-5895-bae4-ae8136ba0164", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.533Z", "created_at": "2026-09-26T02:40:06.723Z", "modified": "2026-09-26T02:40:07.001Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:07.001Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_id": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_name": null, "from_type": "Indicator", "id": "7d3c4c29-2ef8-4cfc-a79b-c050d3223970", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7d103bb4-c9c1-5665-8cd0-8f975ea198f3", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.671Z", "created_at": "2026-09-26T02:42:32.128Z", "modified": "2026-09-26T02:42:32.403Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:32.403Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_id": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "from_name": null, "from_type": "Indicator", "id": "7d578576-9664-4a88-ac5f-bdea8d684d56", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2a4ef8b2-63f6-5c96-9065-141c84fad3c2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.796Z", "created_at": "2026-09-26T02:22:35.269Z", "modified": "2026-09-26T02:22:35.516Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:35.516Z" }, "description_available": false, "entity_type": "based-on", "fromId": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_id": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_name": null, "from_type": "Indicator", "id": "7d85eb78-0d18-419d-9037-9fe0a72b0fc1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7dfee1c1-a13b-5744-a27b-310a13796627", "toId": "48efcbc8-2caf-47cc-a83d-5983beef2772", "to_id": "48efcbc8-2caf-47cc-a83d-5983beef2772", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.481Z", "created_at": "2026-09-26T02:38:14.603Z", "modified": "2026-09-26T02:38:24.425Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:38:24.425Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_id": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_name": null, "from_type": "Indicator", "id": "7e05d7e8-abaf-4190-a0e9-8a196daa899d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4d3eb86a-4988-5f5e-8bbf-b0d5ca0beca0", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:04.027Z", "created_at": "2026-09-26T02:55:56.781Z", "modified": "2026-09-26T02:55:57.114Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:57.114Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_id": "94a25698-514c-48d5-9e05-a337aca9a1b0", "from_name": null, "from_type": "Indicator", "id": "7e40dbd3-710a-4839-93ab-13b0a10b5fa9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2ff32b4a-095e-5fc9-9b4e-ef6ee483b77e", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.093Z", "created_at": "2026-09-26T02:29:06.013Z", "modified": "2026-09-26T02:29:06.388Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:06.388Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_id": "6374cee3-22fc-480b-babc-255ef28c2ad9", "from_name": null, "from_type": "Indicator", "id": "7ebe365c-a702-42dd-878a-45f61f81f763", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--65301119-d0db-5612-92a5-e99cfe87e8bb", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.114Z", "created_at": "2026-09-26T02:29:17.905Z", "modified": "2026-09-26T02:29:19.639Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:19.639Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_id": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "from_name": null, "from_type": "Indicator", "id": "7f47bca1-4bbc-4b0b-8150-7df3f5fdf2fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d8c01fa1-8284-57fa-bc77-0b6eedb7da0c", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.901Z", "created_at": "2026-09-26T02:53:58.060Z", "modified": "2026-09-26T02:53:58.391Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:58.391Z" }, "description_available": false, "entity_type": "indicates", "fromId": "59d5d604-dce0-4819-9e20-9483824295de", "from_id": "59d5d604-dce0-4819-9e20-9483824295de", "from_name": null, "from_type": "Indicator", "id": "7f84cbd7-c0f5-4d33-97e7-b9d6a707d8b6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--628d3e05-02ce-5198-824e-0c574e8ea4b2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.947Z", "created_at": "2026-09-26T02:54:31.923Z", "modified": "2026-09-26T02:54:32.068Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:32.068Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_id": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_name": null, "from_type": "Indicator", "id": "7ff6c9c6-203b-47ec-9358-f4288a1b0552", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b3759007-0ca5-5c41-aa1f-798d3e945f19", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.204Z", "created_at": "2026-09-26T02:30:51.671Z", "modified": "2026-09-26T02:30:52.006Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:52.006Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_id": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_name": null, "from_type": "Indicator", "id": "80090bdd-2f0e-45e6-9c0a-c67058ca85a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b44c01c8-b035-51e5-8286-9fbb8f28b639", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.828Z", "created_at": "2026-09-26T02:23:17.967Z", "modified": "2026-09-26T02:23:19.320Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:19.320Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_id": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "from_name": null, "from_type": "Indicator", "id": "80386912-2835-497f-97e2-deba449dbdf2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b77b524b-60d7-54b1-81a8-747f453117fe", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.532Z", "created_at": "2026-09-26T02:40:08.205Z", "modified": "2026-09-26T02:40:08.631Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:08.631Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_id": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_name": null, "from_type": "Indicator", "id": "8102c66b-397c-4f41-b5e5-db7407d3b977", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3cd9a57e-a426-5c2d-9f27-077b5540d909", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.557Z", "created_at": "2026-09-26T02:17:27.188Z", "modified": "2026-09-26T02:17:27.967Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:27.967Z" }, "description_available": false, "entity_type": "targets", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "811352c8-9353-467e-b47b-e69aeb8a18d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b76e62b9-8d4e-5af6-b89b-e621c974ffc9", "toId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_name": "Non-Governmental Organizations (NGOs)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.246Z", "created_at": "2026-09-26T02:33:09.053Z", "modified": "2026-09-26T02:33:09.333Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:09.333Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_id": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_name": null, "from_type": "Indicator", "id": "84a91d17-5e91-4e64-ad59-48891c37b952", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--20cbd48b-18b3-588f-bbe9-e606c0e68489", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.715Z", "created_at": "2026-09-26T02:22:20.210Z", "modified": "2026-09-26T02:22:20.474Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:20.474Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_id": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_name": null, "from_type": "Indicator", "id": "84cb5a0d-dacf-4136-b5c8-3301a1647f0d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--367974b6-e8a2-5e47-9807-f9e452b42302", "toId": "53c3c310-d81e-49ed-b992-5d808c28c51b", "to_id": "53c3c310-d81e-49ed-b992-5d808c28c51b", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.420Z", "created_at": "2026-09-26T02:36:30.840Z", "modified": "2026-09-26T02:36:31.006Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:31.006Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_id": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_name": null, "from_type": "Indicator", "id": "85aaa069-78c6-494f-a718-4e6f96f1cff2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a0c4da74-64b6-5b06-aebc-07749634e4ef", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.567Z", "created_at": "2026-09-26T02:21:17.260Z", "modified": "2026-09-26T02:21:17.985Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:17.985Z" }, "description_available": false, "entity_type": "targets", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "85b704db-b5f7-4920-bfaf-6b6016d5a110", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d5b05ee7-d418-58a5-8598-11b3447b1027", "toId": "4458b114-0fe4-4d79-beea-3b281c045e08", "to_id": "4458b114-0fe4-4d79-beea-3b281c045e08", "to_name": "CVE-2026-85880", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.791Z", "created_at": "2026-09-26T02:22:33.488Z", "modified": "2026-09-26T02:22:35.015Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:35.015Z" }, "description_available": false, "entity_type": "based-on", "fromId": "78758893-b8ff-478a-87c7-db3374492f48", "from_id": "78758893-b8ff-478a-87c7-db3374492f48", "from_name": null, "from_type": "Indicator", "id": "85ba4528-2b39-4558-becc-a108bcc709ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d9b92aa0-1dfa-5f32-913c-f9066e482a06", "toId": "9e5ea46a-800a-47c4-a6ce-863305dc479d", "to_id": "9e5ea46a-800a-47c4-a6ce-863305dc479d", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.361Z", "created_at": "2026-09-26T02:35:41.516Z", "modified": "2026-09-26T02:35:41.828Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:41.828Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_id": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_name": null, "from_type": "Indicator", "id": "8986acf1-bab8-4a98-8e7b-6fb76db29c8a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a0548e82-9ccf-57f7-855f-acf15c35f99d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.218Z", "created_at": "2026-09-26T02:31:11.728Z", "modified": "2026-09-26T02:31:14.194Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:31:14.194Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_id": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_name": null, "from_type": "Indicator", "id": "89cbb116-caa6-4f13-ac74-dd3a12fe79fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a4a4b57d-dfee-5d6d-aa2f-d64e84960191", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.737Z", "created_at": "2026-09-26T02:46:10.346Z", "modified": "2026-09-26T02:46:11.311Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:46:11.311Z" }, "description_available": false, "entity_type": "indicates", "fromId": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_id": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_name": null, "from_type": "Indicator", "id": "8bd63c4c-d6ad-4937-bff9-8dc0d54d768d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--05aa6808-07b0-5515-88fb-66eb2e599be0", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.260Z", "created_at": "2026-09-26T02:33:27.729Z", "modified": "2026-09-26T02:33:28.059Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:28.059Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_id": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_name": null, "from_type": "Indicator", "id": "8c40b58a-aaf9-4a4c-a47b-736c9d9b2ac9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--45618bd4-d922-5277-90f4-a128b30d4df9", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.975Z", "created_at": "2026-09-26T02:28:01.312Z", "modified": "2026-09-26T02:28:01.490Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:01.490Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_id": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_name": null, "from_type": "Indicator", "id": "8ce3eb8c-0701-4747-ace1-172d05e8b637", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--315111cb-6ae3-5a6e-8f52-eadeee79068e", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.994Z", "created_at": "2026-09-26T02:28:13.206Z", "modified": "2026-09-26T02:28:13.475Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:13.475Z" }, "description_available": false, "entity_type": "indicates", "fromId": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_id": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_name": null, "from_type": "Indicator", "id": "8d0d5984-3943-4120-a3bf-a51b1d18889c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--cab00b72-d6ed-551f-9fdc-a5d228eab50a", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.545Z", "created_at": "2026-09-26T02:40:21.912Z", "modified": "2026-09-26T02:40:22.234Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:22.234Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_id": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_name": null, "from_type": "Indicator", "id": "8d458b73-387a-4697-a078-cbcf64772ed5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e8d10ffa-b4f6-5f8a-8acd-39e99ae0255f", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.804Z", "created_at": "2026-09-26T02:49:52.584Z", "modified": "2026-09-26T02:49:53.009Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:49:53.009Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_id": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_name": null, "from_type": "Indicator", "id": "8df1cc8a-9b93-4e81-9fa1-c32f5b45e817", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--ac368f96-4bd7-55d1-b243-442f6b6f4d66", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.014Z", "created_at": "2026-09-26T02:28:26.893Z", "modified": "2026-09-26T02:28:27.179Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:27.179Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_id": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_name": null, "from_type": "Indicator", "id": "8e83d64d-9068-4e5b-bf82-26552226ca56", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--fb482e5a-d87b-589c-a5a4-dbd2d20aff6f", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.467Z", "created_at": "2026-09-26T02:37:21.675Z", "modified": "2026-09-26T02:37:22.341Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:22.341Z" }, "description_available": false, "entity_type": "indicates", "fromId": "35638839-e7f8-400f-b53f-151f43a9747e", "from_id": "35638839-e7f8-400f-b53f-151f43a9747e", "from_name": null, "from_type": "Indicator", "id": "9120d06b-c4ee-4a57-a5ae-5da7745aa15d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--14cefc8b-b24e-51ee-a566-2bab15b5a133", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.961Z", "created_at": "2026-09-26T02:27:49.201Z", "modified": "2026-09-26T02:27:49.498Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:49.498Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_id": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_name": null, "from_type": "Indicator", "id": "9160d0b6-1ed9-4ec4-a156-d74824c7b88c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d3c723ff-4762-571f-adf9-9a145664f531", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.345Z", "created_at": "2026-09-26T02:35:14.015Z", "modified": "2026-09-26T02:35:14.208Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:14.208Z" }, "description_available": false, "entity_type": "indicates", "fromId": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_id": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_name": null, "from_type": "Indicator", "id": "92202749-d164-498a-a296-5083a5d303d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e4e693d0-834f-5296-8015-5ccf3fe41a29", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.440Z", "created_at": "2026-09-26T02:36:43.406Z", "modified": "2026-09-26T02:36:44.347Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:44.347Z" }, "description_available": false, "entity_type": "indicates", "fromId": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_id": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_name": null, "from_type": "Indicator", "id": "924dd13b-1868-46b8-846b-22fcf8e8d294", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--90b1925a-2cc1-5e63-9d89-1e1bc55d79f8", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.773Z", "created_at": "2026-09-26T02:22:30.210Z", "modified": "2026-09-26T02:22:30.631Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:30.631Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_id": "fbc204e0-b73d-4c21-b240-532955b5d524", "from_name": null, "from_type": "Indicator", "id": "930be580-e79b-44d7-9c7a-cfe7d0a5065b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2a0a79aa-b02a-59a2-a69c-64ec49bf9965", "toId": "bd54d4ad-ddce-4d25-8584-d692e2f5756d", "to_id": "bd54d4ad-ddce-4d25-8584-d692e2f5756d", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.681Z", "created_at": "2026-09-26T02:22:12.367Z", "modified": "2026-09-26T02:22:12.782Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:12.782Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bad82237-3d91-4def-8766-61d38b70be49", "from_id": "bad82237-3d91-4def-8766-61d38b70be49", "from_name": null, "from_type": "Indicator", "id": "9386ff88-3be6-4ce5-a09e-bc83a415cd07", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4dd0e7f5-06cb-54d5-9222-c65a3f19811c", "toId": "6198de79-85e0-4ab6-adb6-f1dca49a28e0", "to_id": "6198de79-85e0-4ab6-adb6-f1dca49a28e0", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.013Z", "created_at": "2026-09-26T02:28:29.133Z", "modified": "2026-09-26T02:28:29.288Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:29.288Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_id": "5b501bee-c49c-41d2-a310-86863ba584cc", "from_name": null, "from_type": "Indicator", "id": "9541b20b-a861-4c5f-9c24-314d61e0aa6c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b8f272e1-896e-512c-8828-d4f849d99352", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.595Z", "created_at": "2026-09-26T02:21:51.205Z", "modified": "2026-09-26T02:21:51.394Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:51.394Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_id": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_name": null, "from_type": "Indicator", "id": "96b8b343-95df-44d8-b23a-8e9d71bae937", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--756cf9bd-f205-51b3-b427-4841d605ca3e", "toId": "83b6823a-45e7-42c1-8865-d839e2f069e1", "to_id": "83b6823a-45e7-42c1-8865-d839e2f069e1", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.702Z", "created_at": "2026-09-26T02:22:18.614Z", "modified": "2026-09-26T02:22:19.490Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:19.490Z" }, "description_available": false, "entity_type": "based-on", "fromId": "21107844-453c-4c82-8366-9715c47845ee", "from_id": "21107844-453c-4c82-8366-9715c47845ee", "from_name": null, "from_type": "Indicator", "id": "9772f42d-e619-43c2-b24e-e40579d58d62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--deec2845-bb4b-5bad-a8d4-8225338cb5b4", "toId": "839dc0d9-ef1a-4249-aeed-24dd1a7fdce6", "to_id": "839dc0d9-ef1a-4249-aeed-24dd1a7fdce6", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.391Z", "created_at": "2026-09-26T02:35:56.387Z", "modified": "2026-09-26T02:35:56.556Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:56.556Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bad82237-3d91-4def-8766-61d38b70be49", "from_id": "bad82237-3d91-4def-8766-61d38b70be49", "from_name": null, "from_type": "Indicator", "id": "99c7c364-873f-4b9c-8624-d801e67a9a1a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e3940179-139e-59e9-9f4d-642b437c809a", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.532Z", "created_at": "2026-09-26T02:40:05.615Z", "modified": "2026-09-26T02:40:05.914Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:05.914Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_id": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_name": null, "from_type": "Indicator", "id": "9a08a0e0-b932-462c-b26f-5f195af6f182", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b6cac9aa-7ce0-5b3d-944e-4fc9af8503e2", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.998Z", "created_at": "2026-09-26T02:55:20.532Z", "modified": "2026-09-26T02:55:21.041Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:21.041Z" }, "description_available": false, "entity_type": "indicates", "fromId": "78758893-b8ff-478a-87c7-db3374492f48", "from_id": "78758893-b8ff-478a-87c7-db3374492f48", "from_name": null, "from_type": "Indicator", "id": "9ad30c70-4411-4f2e-9ce3-9bf583ed5446", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--46b27ea7-2c6c-5a38-bf68-2d1a8706988d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.610Z", "created_at": "2026-09-26T02:21:54.789Z", "modified": "2026-09-26T02:21:56.820Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:56.820Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_id": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "from_name": null, "from_type": "Indicator", "id": "9c19364f-5283-4349-bc82-3efdd64c866f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--43c318b7-72ff-5e40-8946-48f856451c44", "toId": "e5dad1ca-bf44-47ea-b552-5355d7c65a2f", "to_id": "e5dad1ca-bf44-47ea-b552-5355d7c65a2f", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.754Z", "created_at": "2026-09-26T02:22:25.214Z", "modified": "2026-09-26T02:22:27.218Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:27.218Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_id": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_name": null, "from_type": "Indicator", "id": "9cbd6d80-9de5-4053-a436-76ab64190af7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--aa7d3a5d-cebf-58df-ab45-931eeee18cf6", "toId": "92145f60-35b5-4180-a821-8d1fcc64de69", "to_id": "92145f60-35b5-4180-a821-8d1fcc64de69", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.720Z", "created_at": "2026-09-26T02:22:20.669Z", "modified": "2026-09-26T02:22:21.045Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:21.045Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_id": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_name": null, "from_type": "Indicator", "id": "9fe92acd-3f33-4b16-bb2c-adc32ff86487", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f40e7593-8d00-50f1-b303-27b4a88734b1", "toId": "c76493a8-5da7-43b4-8bae-961abf2b98b3", "to_id": "c76493a8-5da7-43b4-8bae-961abf2b98b3", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.590Z", "created_at": "2026-09-26T02:41:18.184Z", "modified": "2026-09-26T02:41:18.471Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:18.471Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_id": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_name": null, "from_type": "Indicator", "id": "a0948410-d067-4175-8f15-6d7b1526d1ff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--92b04c1f-9c74-5601-b565-a50b2f321794", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.984Z", "created_at": "2026-09-26T02:55:02.448Z", "modified": "2026-09-26T02:55:02.811Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:02.811Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_id": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_name": null, "from_type": "Indicator", "id": "a11a2309-63c5-4d63-a344-7d50f2136d86", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--06a04585-3411-56c4-b804-28027d98d93b", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.804Z", "created_at": "2026-09-26T02:49:47.925Z", "modified": "2026-09-26T02:49:48.618Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:49:48.618Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_id": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_name": null, "from_type": "Indicator", "id": "a1d790aa-fb03-4d7f-aa06-10b500a5fc7c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--055f63ad-e03c-5e6c-8551-7abb4198044a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.137Z", "created_at": "2026-09-26T02:29:38.798Z", "modified": "2026-09-26T02:29:39.955Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:39.955Z" }, "description_available": false, "entity_type": "indicates", "fromId": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_id": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_name": null, "from_type": "Indicator", "id": "a349deb3-c615-45b5-b699-f3afac448d74", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6cbf9a7d-d2d1-5ebb-9261-0cda187367d8", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.374Z", "created_at": "2026-09-26T02:35:41.083Z", "modified": "2026-09-26T02:35:41.578Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:41.578Z" }, "description_available": false, "entity_type": "indicates", "fromId": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_id": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_name": null, "from_type": "Indicator", "id": "a37c268f-45e7-47e8-b398-234ec06548a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d6d6c129-92c6-5ad8-b999-d85273fc6c46", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.982Z", "created_at": "2026-09-26T02:55:01.783Z", "modified": "2026-09-26T02:55:01.979Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:01.979Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_id": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_name": null, "from_type": "Indicator", "id": "a37d634b-1e03-482b-a16f-02c1a1f4e136", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4b0aaae1-3080-55c8-8864-87ee73ccbc4f", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.777Z", "created_at": "2026-09-26T02:48:43.176Z", "modified": "2026-09-26T02:48:43.584Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:48:43.584Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_id": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_name": null, "from_type": "Indicator", "id": "a4b0f641-3863-4dfb-99e0-b9fca53af692", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4ff77c47-3a46-532a-87b7-e5d6d6b4dabf", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.545Z", "created_at": "2026-09-26T02:40:22.529Z", "modified": "2026-09-26T02:40:22.709Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:22.709Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_id": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_name": null, "from_type": "Indicator", "id": "a507e505-d8c1-48c1-bafd-15d5f998d95c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5e4fbbb1-d6d3-51a9-870c-aad05cf6045e", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.811Z", "created_at": "2026-09-26T02:22:57.394Z", "modified": "2026-09-26T02:22:57.656Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:57.656Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_id": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_name": null, "from_type": "Indicator", "id": "a6580221-bee4-49f4-a66d-00367359d14f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--ae127ed8-1d92-552b-aeb9-97786875b8c4", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.686Z", "created_at": "2026-09-26T02:22:13.653Z", "modified": "2026-09-26T02:22:14.017Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:14.017Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_id": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "from_name": null, "from_type": "Indicator", "id": "a6da9767-e820-4f9d-bc20-98760e5487ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e14f5cc6-5508-5620-9bb2-f9342d3545b9", "toId": "93e44490-3da8-4ef2-9e1d-a6ef233e26f5", "to_id": "93e44490-3da8-4ef2-9e1d-a6ef233e26f5", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.707Z", "created_at": "2026-09-26T02:22:19.473Z", "modified": "2026-09-26T02:22:19.817Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:19.817Z" }, "description_available": false, "entity_type": "based-on", "fromId": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_id": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "from_name": null, "from_type": "Indicator", "id": "a72c859c-9a46-4065-b0d3-982e260fc8e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--ce2df91b-ce24-51ed-afe2-ad4d90fcf01d", "toId": "3a8f5384-8175-4b0a-9b19-c6f11c754628", "to_id": "3a8f5384-8175-4b0a-9b19-c6f11c754628", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.725Z", "created_at": "2026-09-26T02:22:21.443Z", "modified": "2026-09-26T02:22:21.867Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:21.867Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5362aa72-f60c-4284-807f-56610dba2887", "from_id": "5362aa72-f60c-4284-807f-56610dba2887", "from_name": null, "from_type": "Indicator", "id": "a7317a26-45cd-41d6-b73b-e9b2aa569a4c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7c5d1e56-567d-50ab-815a-38da181e304d", "toId": "1404b049-de33-4250-8426-69f3e5b168df", "to_id": "1404b049-de33-4250-8426-69f3e5b168df", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.272Z", "created_at": "2026-09-26T02:33:45.920Z", "modified": "2026-09-26T02:33:46.225Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:46.225Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_id": "b7867e87-ea84-48b0-a6f2-0cebbe33b644", "from_name": null, "from_type": "Indicator", "id": "a816e2ed-34e2-437f-904c-cc990fb00606", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3f3dc364-9398-5586-8e1a-02dd0e1f2730", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.900Z", "created_at": "2026-09-26T02:53:53.732Z", "modified": "2026-09-26T02:53:53.949Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:53.949Z" }, "description_available": false, "entity_type": "indicates", "fromId": "59d5d604-dce0-4819-9e20-9483824295de", "from_id": "59d5d604-dce0-4819-9e20-9483824295de", "from_name": null, "from_type": "Indicator", "id": "a90ca97a-2108-412a-8311-d0ba411108ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--159f2b6f-8830-591c-ae24-6d8ff46c1315", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.948Z", "created_at": "2026-09-26T02:54:25.656Z", "modified": "2026-09-26T02:54:25.901Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:25.901Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_id": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "from_name": null, "from_type": "Indicator", "id": "a91512e3-63c0-4efa-a619-9be9b520f494", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4ea28bc4-46f8-5b9b-ac88-5b8a8b8379e6", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.665Z", "created_at": "2026-09-26T02:22:10.016Z", "modified": "2026-09-26T02:22:10.433Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:10.433Z" }, "description_available": false, "entity_type": "based-on", "fromId": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_id": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_name": null, "from_type": "Indicator", "id": "a94fa6ae-8609-4bf5-9b44-69216aac6c4e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b78141e5-c79f-53ea-94fe-7313a522b1b5", "toId": "a9ecaf49-407d-42d8-8fc2-9c0dff497fac", "to_id": "a9ecaf49-407d-42d8-8fc2-9c0dff497fac", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.629Z", "created_at": "2026-09-26T02:22:00.495Z", "modified": "2026-09-26T02:22:00.655Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:00.655Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_id": "8a294068-ba4c-44c3-aa84-f37ee494decf", "from_name": null, "from_type": "Indicator", "id": "a9816a03-0a74-4e50-9fae-d42b8c2c2b5f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--62a83cc0-f411-525e-b002-602601a39574", "toId": "3e7fec84-f94e-4720-b965-aef3172a3563", "to_id": "3e7fec84-f94e-4720-b965-aef3172a3563", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.711Z", "created_at": "2026-09-26T02:43:44.768Z", "modified": "2026-09-26T02:43:49.853Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:43:49.853Z" }, "description_available": false, "entity_type": "indicates", "fromId": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_id": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_name": null, "from_type": "Indicator", "id": "a9b8ce22-d7a1-4eba-aa61-2db7dd6b0701", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1a8cc58e-3ff9-5c93-ac32-13bc88899eb2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.846Z", "created_at": "2026-09-26T02:52:51.339Z", "modified": "2026-09-26T02:52:51.847Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:52:51.847Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_id": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_name": null, "from_type": "Indicator", "id": "aa8f4283-8d58-4773-a68a-0127a9da2be4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--22c78a76-2639-5edc-834b-b9695f9b65c3", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.454Z", "created_at": "2026-09-26T02:37:04.854Z", "modified": "2026-09-26T02:37:05.402Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:05.402Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_id": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_name": null, "from_type": "Indicator", "id": "aaaae470-de64-41a6-897d-83d8211188a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2ce0e6c2-e022-517e-b077-f6c515dc64b4", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.311Z", "created_at": "2026-09-26T02:34:42.392Z", "modified": "2026-09-26T02:34:43.083Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:43.083Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_id": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_name": null, "from_type": "Indicator", "id": "aab612c8-ea8e-4162-b1e1-813aef446a47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--acc835a4-b91c-5f5f-98f1-d1e517f0460e", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.997Z", "created_at": "2026-09-26T02:55:19.483Z", "modified": "2026-09-26T02:55:19.880Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:55:19.880Z" }, "description_available": false, "entity_type": "indicates", "fromId": "78758893-b8ff-478a-87c7-db3374492f48", "from_id": "78758893-b8ff-478a-87c7-db3374492f48", "from_name": null, "from_type": "Indicator", "id": "ac25f82b-1c8e-47db-b642-89ef0d98adbf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e5fad349-263f-5f1f-b775-137e203e7e6c", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.914Z", "created_at": "2026-09-26T02:27:00.474Z", "modified": "2026-09-26T02:27:00.880Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:00.880Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_id": "0ec251c1-766b-4051-bb1f-be554a9c4aa5", "from_name": null, "from_type": "Indicator", "id": "ac4f5537-25c2-43fa-ad7f-4de56309e6eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a35781e5-a1c3-5971-be28-daf8ade86f5e", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.841Z", "created_at": "2026-09-26T02:23:39.758Z", "modified": "2026-09-26T02:23:39.914Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:39.914Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_id": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_name": null, "from_type": "Indicator", "id": "ac5b4a19-d989-4ad0-94fb-391c6297fa8c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--479e3c69-c745-59e4-9145-4c538ab4f071", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.375Z", "created_at": "2026-09-26T02:35:50.909Z", "modified": "2026-09-26T02:35:51.098Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:51.098Z" }, "description_available": false, "entity_type": "indicates", "fromId": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_id": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_name": null, "from_type": "Indicator", "id": "ad4fabc5-aea5-4954-b0dc-d1335782189d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--00e8e477-bc3c-5a3e-9aac-a9372697ddf8", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.960Z", "created_at": "2026-09-26T02:27:44.244Z", "modified": "2026-09-26T02:27:44.568Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:44.568Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_id": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_name": null, "from_type": "Indicator", "id": "adb8d811-4910-4cb3-acbe-ccc70580c1ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--653e7ea1-05ba-5153-aecb-7d8cc7508adb", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.817Z", "created_at": "2026-09-26T02:50:28.246Z", "modified": "2026-09-26T02:50:28.670Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:50:28.670Z" }, "description_available": false, "entity_type": "indicates", "fromId": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_id": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_name": null, "from_type": "Indicator", "id": "ae258bd8-5cde-46b9-9690-59f44ca9d57c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a2256fc2-169d-56f0-8c64-9e3deb719047", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.617Z", "created_at": "2026-09-26T02:21:57.711Z", "modified": "2026-09-26T02:21:58.270Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:58.270Z" }, "description_available": false, "entity_type": "based-on", "fromId": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_id": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_name": null, "from_type": "Indicator", "id": "af3318ff-1c01-403a-bc0c-55b526f9af87", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--704f0108-8037-5a6b-a360-29d636d2cc44", "toId": "17803863-37e3-4ced-940a-96e1cc05301d", "to_id": "17803863-37e3-4ced-940a-96e1cc05301d", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.658Z", "created_at": "2026-09-26T02:22:06.386Z", "modified": "2026-09-26T02:22:07.702Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:07.702Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_id": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_name": null, "from_type": "Indicator", "id": "af39481e-ea76-4b7e-a9ac-583de6a0a7a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--37cc4a10-55dc-54ff-8511-12054b5e7b50", "toId": "134a3884-e439-4d6a-a889-bace089a0636", "to_id": "134a3884-e439-4d6a-a889-bace089a0636", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.454Z", "created_at": "2026-09-26T02:37:05.931Z", "modified": "2026-09-26T02:37:06.146Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:06.146Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_id": "0072d61c-6d01-4865-8246-0725c6e54b11", "from_name": null, "from_type": "Indicator", "id": "af7ff2fa-dc7e-4000-bba1-7e5f57e804fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e7997182-0df5-5ad1-9df0-577f584da4a6", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.942Z", "created_at": "2026-09-26T02:27:28.159Z", "modified": "2026-09-26T02:27:28.638Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:28.638Z" }, "description_available": false, "entity_type": "indicates", "fromId": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_id": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_name": null, "from_type": "Indicator", "id": "af9db46b-e72e-4571-8835-ecc3009d762d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bac1d84a-c197-5e11-97d5-05e13b7a2234", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.645Z", "created_at": "2026-09-26T02:42:02.410Z", "modified": "2026-09-26T02:42:02.745Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:02.745Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5362aa72-f60c-4284-807f-56610dba2887", "from_id": "5362aa72-f60c-4284-807f-56610dba2887", "from_name": null, "from_type": "Indicator", "id": "b0c8fe1d-ba30-4f3f-96de-51f73f3a7af8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--40deac56-5654-5c04-bdc3-f975d760b94a", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.405Z", "created_at": "2026-09-26T02:36:09.270Z", "modified": "2026-09-26T02:36:09.744Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:09.744Z" }, "description_available": false, "entity_type": "indicates", "fromId": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_id": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_name": null, "from_type": "Indicator", "id": "b0ec0408-f2b3-4284-a924-4941b1580ac5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--0d768d32-68a9-55a0-8b7f-9f7e02557164", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.589Z", "created_at": "2026-09-26T02:41:11.220Z", "modified": "2026-09-26T02:41:11.394Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:11.394Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_id": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_name": null, "from_type": "Indicator", "id": "b0fab798-6ce9-4b18-b120-895b5bce0bc8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--23d47839-eedd-5c23-9802-75e2e4c969e4", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.286Z", "created_at": "2026-09-26T02:34:07.788Z", "modified": "2026-09-26T02:34:08.461Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:08.461Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_id": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_name": null, "from_type": "Indicator", "id": "b1015a38-2748-4d30-9cb5-d17316a33231", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--13f4dfb1-9393-5264-9913-801ed8a06161", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.974Z", "created_at": "2026-09-26T02:27:58.744Z", "modified": "2026-09-26T02:27:59.040Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:59.040Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_id": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_name": null, "from_type": "Indicator", "id": "b25f377d-c3f0-40bd-b5ba-a48143ef6242", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--9ad023ec-1c82-52ff-a250-71501013f896", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.976Z", "created_at": "2026-09-26T02:27:59.464Z", "modified": "2026-09-26T02:28:00.368Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:00.368Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_id": "65d6b799-01bf-4037-a390-c9d8f96014f3", "from_name": null, "from_type": "Indicator", "id": "b2a70b82-bf7f-4b15-b9b7-5c44492361aa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f6382e69-840f-522d-92a2-fbad2c24ec0e", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.506Z", "created_at": "2026-09-26T02:39:25.902Z", "modified": "2026-09-26T02:39:26.140Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:26.140Z" }, "description_available": false, "entity_type": "indicates", "fromId": "21107844-453c-4c82-8366-9715c47845ee", "from_id": "21107844-453c-4c82-8366-9715c47845ee", "from_name": null, "from_type": "Indicator", "id": "b2e86d7f-2f52-4388-8b63-25904de250b9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--98aeee9d-2c8e-5872-a488-c74cf1a7efae", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:22.125Z", "modified": "2026-01-18T14:35:22.364Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:35:22.364Z" }, "description_available": true, "entity_type": "part-of", "fromId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "from_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "from_name": "Air transport", "from_type": "Sector", "id": "b3434cc4-76d3-42c8-92a8-5514937dc9d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "part-of", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--01b463cc-7632-5741-8c0e-5d8a1a18a15b", "toId": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "to_id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "to_name": "Transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.520Z", "created_at": "2026-09-26T02:39:46.862Z", "modified": "2026-09-26T02:39:47.238Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:47.238Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_id": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_name": null, "from_type": "Indicator", "id": "b3a86a01-baa9-49d5-8886-f9cd9878b1d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8f268cdb-fbd3-5165-8345-67989cdf267d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.759Z", "created_at": "2026-09-26T02:22:27.639Z", "modified": "2026-09-26T02:22:28.969Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:28.969Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_id": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_name": null, "from_type": "Indicator", "id": "b3ca95d9-0f74-42a2-90ed-74b5f92a0990", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--19eddb7f-450a-50f1-8937-2b3c1b4c8f53", "toId": "08bd69a6-c22b-4af8-9b6a-bad9e7025e27", "to_id": "08bd69a6-c22b-4af8-9b6a-bad9e7025e27", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.555Z", "created_at": "2026-09-26T02:17:19.585Z", "modified": "2026-09-26T02:17:20.196Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:20.196Z" }, "description_available": false, "entity_type": "targets", "fromId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_name": "GemStone", "from_type": "Malware", "id": "b560045f-b735-4add-b5d5-f0e496d1bd7d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1c09bec5-d765-529a-ac6b-cc3daa4f8756", "toId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_name": "Non-Governmental Organizations (NGOs)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.565Z", "created_at": "2026-09-26T02:21:10.874Z", "modified": "2026-09-26T02:21:11.380Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:11.380Z" }, "description_available": false, "entity_type": "targets", "fromId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_name": "GemStone", "from_type": "Malware", "id": "b643eb54-eb3f-45c4-b27a-9b74724457b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--19ff80cf-f17d-5e6f-8e47-a95f146f90b9", "toId": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "to_id": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "to_name": "CVE-2026-85046", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.845Z", "created_at": "2026-09-26T02:52:53.132Z", "modified": "2026-09-26T02:52:53.429Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:52:53.429Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_id": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "from_name": null, "from_type": "Indicator", "id": "b64d1214-1521-4285-b10e-6ce8075d4d98", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--021be742-0e7b-55f2-b9cc-6ab81a98c33c", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.644Z", "created_at": "2026-09-26T02:42:00.139Z", "modified": "2026-09-26T02:42:00.660Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:00.660Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5362aa72-f60c-4284-807f-56610dba2887", "from_id": "5362aa72-f60c-4284-807f-56610dba2887", "from_name": null, "from_type": "Indicator", "id": "b85339c1-7d08-4991-84ce-e1f94e46f2cf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--62f34aee-8159-58b4-8342-e35ec7f5362d", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.566Z", "created_at": "2026-09-26T02:21:22.954Z", "modified": "2026-09-26T02:21:23.147Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:23.147Z" }, "description_available": false, "entity_type": "targets", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "b93d4db7-72b7-4aaa-99ef-3a27f67dfb85", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5f3f2f22-d2de-566f-9f78-c886c805b237", "toId": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "to_id": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "to_name": "CVE-2026-85046", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.327Z", "created_at": "2026-09-26T02:34:56.689Z", "modified": "2026-09-26T02:34:56.929Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:56.929Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_id": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_name": null, "from_type": "Indicator", "id": "b9cd8bae-ce37-4a78-8ad8-fa857b305d5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3043cb74-f930-5e8c-a685-720cb240fec9", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.842Z", "created_at": "2026-09-26T02:23:38.694Z", "modified": "2026-09-26T02:23:39.019Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:39.019Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_id": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "from_name": null, "from_type": "Indicator", "id": "bab03a8c-43f7-49ae-981d-5a396667d6fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f9f5289e-691d-5dee-a09f-65b1f1dba010", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.441Z", "created_at": "2026-09-26T02:36:46.022Z", "modified": "2026-09-26T02:36:46.347Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:46.347Z" }, "description_available": false, "entity_type": "indicates", "fromId": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_id": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_name": null, "from_type": "Indicator", "id": "bab29901-be1f-451c-bfeb-b8f2fdff1283", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5a4f5c84-b9c7-5514-8717-261139001497", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.993Z", "created_at": "2026-09-26T02:28:12.673Z", "modified": "2026-09-26T02:28:12.971Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:12.971Z" }, "description_available": false, "entity_type": "indicates", "fromId": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_id": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_name": null, "from_type": "Indicator", "id": "bcc21eec-2384-48fd-8b95-bdf5afb37fdb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--895542ed-093d-5067-97c6-eb24e5fa1462", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.658Z", "created_at": "2026-09-26T02:42:17.824Z", "modified": "2026-09-26T02:42:17.995Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:17.995Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_id": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "from_name": null, "from_type": "Indicator", "id": "bd11e40a-5d27-472a-b9e5-d5a89a463951", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--372464f9-d0f6-5dfe-93c0-4647d2059d21", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.870Z", "created_at": "2026-09-26T02:24:59.372Z", "modified": "2026-09-26T02:25:05.943Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:25:05.943Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_id": "dd901a81-11dd-4326-9220-8c317d33c0d1", "from_name": null, "from_type": "Indicator", "id": "bd1861be-4d54-41d6-b1b0-a122e375a58d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c44a19a1-7277-5f38-bcc0-994c61c9ca9e", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.688Z", "created_at": "2026-09-26T02:22:13.722Z", "modified": "2026-09-26T02:22:14.385Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:14.385Z" }, "description_available": false, "entity_type": "based-on", "fromId": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_id": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_name": null, "from_type": "Indicator", "id": "bd721330-337e-44e2-a4d6-a5f9498cfe08", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8e1d0a9f-de12-5bb8-9653-83c3f5592865", "toId": "893a0a60-708c-4e05-b761-8c87dc4b7486", "to_id": "893a0a60-708c-4e05-b761-8c87dc4b7486", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.777Z", "created_at": "2026-09-26T02:48:47.724Z", "modified": "2026-09-26T02:48:48.007Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:48:48.007Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_id": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_name": null, "from_type": "Indicator", "id": "beeb0ca8-f067-4fa0-a422-b1991effc62f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b8ae4176-d659-5061-9f7e-00a27c3042a4", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.832Z", "created_at": "2026-09-26T02:51:44.620Z", "modified": "2026-09-26T02:51:54.809Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:51:54.809Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_id": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_name": null, "from_type": "Indicator", "id": "c04eb270-3541-4b70-9d36-8c6e3692ce74", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--172e26ae-c978-53e9-a1a9-473302867bc4", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.672Z", "created_at": "2026-09-26T02:22:11.326Z", "modified": "2026-09-26T02:22:11.739Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:11.739Z" }, "description_available": false, "entity_type": "based-on", "fromId": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_id": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_name": null, "from_type": "Indicator", "id": "c07c1f4b-f57a-4c56-afc9-519c6d646b96", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e70f8213-b9ee-547e-acb6-8e118c9b3c3d", "toId": "75a38a71-04ed-4526-95d0-66d4435b1918", "to_id": "75a38a71-04ed-4526-95d0-66d4435b1918", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.855Z", "created_at": "2026-09-26T02:23:59.336Z", "modified": "2026-09-26T02:23:59.527Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:23:59.527Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_id": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_name": null, "from_type": "Indicator", "id": "c11eb959-2e87-4974-bc84-d04075d82b38", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--50047f3c-0a5c-5d18-afae-68ab35e1a0bb", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.812Z", "created_at": "2026-09-26T02:22:58.016Z", "modified": "2026-09-26T02:22:59.071Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:59.071Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_id": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_name": null, "from_type": "Indicator", "id": "c32305ba-067c-438b-add8-8747b085fbef", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--30da0871-0652-53ca-ab34-bbe5857b8d3d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.886Z", "created_at": "2026-09-26T02:53:43.838Z", "modified": "2026-09-26T02:53:44.030Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:44.030Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_id": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_name": null, "from_type": "Indicator", "id": "c332888a-84e5-44ce-88c1-a912c6354df5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b977dd74-1f5f-5a03-8b2b-f623326dae49", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.704Z", "created_at": "2026-09-26T02:22:19.458Z", "modified": "2026-09-26T02:22:19.734Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:19.734Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_id": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_name": null, "from_type": "Indicator", "id": "c36bbf4e-e69c-47b2-95d5-7554b423a5a9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--cbe34823-e125-5cd1-a947-0e9fd9699b52", "toId": "89e233b2-a13d-4a8a-9aea-20786f0d9044", "to_id": "89e233b2-a13d-4a8a-9aea-20786f0d9044", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.360Z", "created_at": "2026-09-26T02:35:34.009Z", "modified": "2026-09-26T02:35:34.170Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:34.170Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_id": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "from_name": null, "from_type": "Indicator", "id": "c3851471-0d0c-4458-9af2-ae4d3744cc5b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--001909c2-f34c-59a1-9aff-438c55ed60b2", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.551Z", "created_at": "2026-09-26T02:17:11.252Z", "modified": "2026-09-26T02:17:12.848Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:12.848Z" }, "description_available": false, "entity_type": "targets", "fromId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_name": "BlueMoon", "from_type": "Malware", "id": "c566ad32-55c5-42ef-bafa-cde1b3f6698d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--509dadc4-bbf4-5859-9a11-7daf9d5f4522", "toId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_name": "Air transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.624Z", "created_at": "2026-09-26T02:41:45.667Z", "modified": "2026-09-26T02:41:45.858Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:45.858Z" }, "description_available": false, "entity_type": "indicates", "fromId": "acd924c0-2829-463e-a00a-14a40a617329", "from_id": "acd924c0-2829-463e-a00a-14a40a617329", "from_name": null, "from_type": "Indicator", "id": "c58b7bfc-ba00-4318-8b14-93392ae89bc6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c6b7ba6c-7b44-5be1-bd53-51c85fa885aa", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.232Z", "created_at": "2026-09-26T02:32:47.449Z", "modified": "2026-09-26T02:32:47.613Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:32:47.613Z" }, "description_available": false, "entity_type": "indicates", "fromId": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_id": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_name": null, "from_type": "Indicator", "id": "c6080b04-9769-4ddc-ac41-6902d147be4e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c9d93be8-85f9-5703-bca0-77645ae75d45", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.750Z", "created_at": "2026-09-26T02:46:36.337Z", "modified": "2026-09-26T02:46:36.984Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:46:36.984Z" }, "description_available": false, "entity_type": "indicates", "fromId": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_id": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_name": null, "from_type": "Indicator", "id": "c6af72d9-68d8-4b9c-83bf-59fc68ccca55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--37c8bb3b-b7e2-5d4c-a7d4-06265b51aace", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.965Z", "created_at": "2026-09-26T02:54:52.225Z", "modified": "2026-09-26T02:54:52.426Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:52.426Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_id": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_name": null, "from_type": "Indicator", "id": "c86fb43b-9656-4eba-98c4-aa1b702438a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--011dcbfc-a066-5757-8346-9f8615e694a0", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.724Z", "created_at": "2026-09-26T02:45:56.405Z", "modified": "2026-09-26T02:45:56.627Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:45:56.627Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_id": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_name": null, "from_type": "Indicator", "id": "c8d09a28-e95f-4e55-82fb-61af5ec31c5f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--81c80352-2a32-51ec-b25d-a2a37085f315", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.573Z", "created_at": "2026-09-26T02:40:53.678Z", "modified": "2026-09-26T02:40:53.879Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:53.879Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_id": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_name": null, "from_type": "Indicator", "id": "c8f6bafe-76b7-46eb-ae3f-3eeea56b96f0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--dfb12531-a330-5fd2-ba49-851fefc1eb29", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.684Z", "created_at": "2026-09-26T02:42:48.256Z", "modified": "2026-09-26T02:42:48.528Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:48.528Z" }, "description_available": false, "entity_type": "indicates", "fromId": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_id": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_name": null, "from_type": "Indicator", "id": "c98f8221-ddb1-4d55-9067-5ba9403952c0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--62b574ad-2cbb-5782-8e1f-79b02436aa36", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.966Z", "created_at": "2026-09-26T02:54:45.875Z", "modified": "2026-09-26T02:54:46.126Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:46.126Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_id": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_name": null, "from_type": "Indicator", "id": "c9b93af4-a230-4139-9867-97022461f6ab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c090936d-a56c-5847-89d8-d231d62b09bf", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.564Z", "created_at": "2026-09-26T02:21:13.198Z", "modified": "2026-09-26T02:21:16.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:16.464Z" }, "description_available": false, "entity_type": "targets", "fromId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_name": "BlueMoon", "from_type": "Malware", "id": "ca0117fe-5b7f-49c1-b5e3-bb300cae981e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d8ef3d42-62d7-50fb-aafe-a987581fa057", "toId": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "to_id": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "to_name": "CVE-2026-85046", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.480Z", "created_at": "2026-09-26T02:37:41.071Z", "modified": "2026-09-26T02:37:41.219Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:41.219Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_id": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_name": null, "from_type": "Indicator", "id": "cb8b874d-8f6f-4ff7-87ac-42ed4fff7a35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--cc79ec9f-5fe0-5ccc-b35f-db022ae5db9b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.928Z", "created_at": "2026-09-26T02:27:19.945Z", "modified": "2026-09-26T02:27:20.140Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:20.140Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_id": "a604bb75-2767-4014-bfaa-f033d7a5df31", "from_name": null, "from_type": "Indicator", "id": "cbbd5d3f-ece6-4a99-853c-d025c652e9fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8d9d87fa-679e-5503-8c4a-257fdf6435c3", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.805Z", "created_at": "2026-09-26T02:49:49.924Z", "modified": "2026-09-26T02:49:50.341Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:49:50.341Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_id": "e458d8a0-4ad3-4d34-8a3e-0d1ad4064f61", "from_name": null, "from_type": "Indicator", "id": "cdafefca-c7f7-4132-8e52-c11bdad89d11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--92e945cb-6d7d-51dc-807a-23d78b8412d2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.764Z", "created_at": "2026-09-26T02:48:35.835Z", "modified": "2026-09-26T02:48:36.161Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:48:36.161Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_id": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_name": null, "from_type": "Indicator", "id": "ce511657-5577-4f5e-9ccb-bc33fff0bdc0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d7a1e712-0d0f-5a8f-9f11-bd75e1c0eed4", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.644Z", "created_at": "2026-09-26T02:22:03.439Z", "modified": "2026-09-26T02:22:03.862Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:03.862Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_id": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_name": null, "from_type": "Indicator", "id": "cef1c38f-48e2-49d7-9b06-ddbefb135503", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1e824f86-b069-54a8-84a2-0d27d7d5f404", "toId": "0400826f-b2c0-4aff-acf3-2ec6ccc4a9ca", "to_id": "0400826f-b2c0-4aff-acf3-2ec6ccc4a9ca", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.812Z", "created_at": "2026-09-26T02:22:59.206Z", "modified": "2026-09-26T02:22:59.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:59.348Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_id": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "from_name": null, "from_type": "Indicator", "id": "cfb0e794-3a30-408b-a227-8cbe65d059d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--52cfa902-7d19-58ce-8bf8-f95a0138cc37", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.859Z", "created_at": "2026-09-26T02:53:09.879Z", "modified": "2026-09-26T02:53:10.068Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:10.068Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_id": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "from_name": null, "from_type": "Indicator", "id": "d61a6d74-3efc-40ea-9e04-89679e2a1d4d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3fb9f1b2-9fea-5212-89ee-9e76654e5e66", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.519Z", "created_at": "2026-09-26T02:39:49.577Z", "modified": "2026-09-26T02:39:49.743Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:39:49.743Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_id": "bfda401c-dab3-403d-9abc-99fe172d3865", "from_name": null, "from_type": "Indicator", "id": "d666792e-c8c2-4de5-b134-9fb3f86cab81", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--95912be1-13d7-5230-8b75-e5a4418e49c2", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.722Z", "created_at": "2026-09-26T02:22:21.073Z", "modified": "2026-09-26T02:22:21.407Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:21.407Z" }, "description_available": false, "entity_type": "based-on", "fromId": "acd924c0-2829-463e-a00a-14a40a617329", "from_id": "acd924c0-2829-463e-a00a-14a40a617329", "from_name": null, "from_type": "Indicator", "id": "d97430f9-0653-470f-9dbc-81d538f23595", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--03821bf5-d425-53b0-b530-a5ca2c8c2ed2", "toId": "42e8572c-e512-48bc-9f33-4ffa9a8cb4f7", "to_id": "42e8572c-e512-48bc-9f33-4ffa9a8cb4f7", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.793Z", "created_at": "2026-09-26T02:22:34.758Z", "modified": "2026-09-26T02:22:35.206Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:35.206Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_id": "fbdda215-d56a-448f-a95c-665f7567d62a", "from_name": null, "from_type": "Indicator", "id": "d9903864-072d-47e0-91fa-0d9a86ad271b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--902e6c45-b4fd-52d5-98f5-c1d66b2ce87c", "toId": "4de21850-3b3b-4151-b8b2-a3a9bca79791", "to_id": "4de21850-3b3b-4151-b8b2-a3a9bca79791", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.620Z", "created_at": "2026-09-26T02:21:57.716Z", "modified": "2026-09-26T02:21:58.271Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:58.271Z" }, "description_available": false, "entity_type": "based-on", "fromId": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_id": "de7c3530-8b9e-4f86-9503-42f21e038f33", "from_name": null, "from_type": "Indicator", "id": "daa02821-0c5c-4d3b-a61d-3d32e9948333", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--2352d5cf-b846-5c32-8257-67e84b967b86", "toId": "0885fca1-e435-4ddc-a6f2-5df5ecd4ff6c", "to_id": "0885fca1-e435-4ddc-a6f2-5df5ecd4ff6c", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:15:17.102Z", "created_at": "2026-03-08T08:04:46.856Z", "modified": "2026-03-08T08:04:48.056Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-08T08:04:48.056Z" }, "description_available": false, "entity_type": "targets", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "dae24b13-5977-4223-b23d-9b2d876205b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--db16174d-c143-5ee8-8197-8afcf52f0b4a", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.247Z", "created_at": "2026-09-26T02:33:10.287Z", "modified": "2026-09-26T02:33:10.733Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:10.733Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_id": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_name": null, "from_type": "Indicator", "id": "db37e4e5-55e0-4ed2-97e5-63ac070cae76", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--988b20cd-e0e9-5e92-a6f0-80ca6b843024", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.765Z", "created_at": "2026-09-26T02:22:29.048Z", "modified": "2026-09-26T02:22:29.552Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:29.552Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_id": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "from_name": null, "from_type": "Indicator", "id": "dd83757a-1cb2-4363-8538-9c84c7d935f8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--812e1527-9bd7-5784-b945-7f37c82db5d7", "toId": "a8296d14-60fc-4411-bfd6-8016ac7e0322", "to_id": "a8296d14-60fc-4411-bfd6-8016ac7e0322", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.574Z", "created_at": "2026-09-26T02:40:54.140Z", "modified": "2026-09-26T02:40:54.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:54.464Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_id": "f3c13de1-2b2f-4a16-aed6-e76678178416", "from_name": null, "from_type": "Indicator", "id": "de48ac08-ba3d-4293-a554-646eaf4cc41c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--cf05cea4-394d-53f7-b42f-17816ded4776", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.135Z", "created_at": "2026-09-26T02:29:38.500Z", "modified": "2026-09-26T02:29:38.643Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:29:38.643Z" }, "description_available": false, "entity_type": "indicates", "fromId": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_id": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "from_name": null, "from_type": "Indicator", "id": "deb29531-4154-43e1-82d1-12e6b809e171", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--60de8344-4beb-518a-9856-92862bbb6fef", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.711Z", "created_at": "2026-09-26T02:43:38.685Z", "modified": "2026-09-26T02:43:39.229Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:43:39.229Z" }, "description_available": false, "entity_type": "indicates", "fromId": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_id": "73ab01ce-8793-409b-8d77-693b01e232ac", "from_name": null, "from_type": "Indicator", "id": "dfe8f69e-c91b-4a5a-8473-9f1d109f7fb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--06c75c7d-b0d4-57db-96ef-b9d819728f1a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.260Z", "created_at": "2026-09-26T02:33:28.441Z", "modified": "2026-09-26T02:33:28.571Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:33:28.571Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_id": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "from_name": null, "from_type": "Indicator", "id": "e0d0da82-5835-4b9f-898d-1d2afdc178a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--0704d1f9-bff2-5162-a640-85cfd06e437c", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.943Z", "created_at": "2026-09-26T02:27:28.909Z", "modified": "2026-09-26T02:27:29.200Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:27:29.200Z" }, "description_available": false, "entity_type": "indicates", "fromId": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_id": "330cdc7b-250c-4e29-8b27-6fa7454ac897", "from_name": null, "from_type": "Indicator", "id": "e161430e-7f1d-4fbb-a0c7-ead7bde7012f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--111f3d99-d1ef-5d3e-a755-cae5a95dcc70", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.624Z", "created_at": "2026-09-26T02:21:59.874Z", "modified": "2026-09-26T02:22:00.170Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:00.170Z" }, "description_available": false, "entity_type": "based-on", "fromId": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_id": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_name": null, "from_type": "Indicator", "id": "e1b188b9-90b4-4a15-83c6-62e6d6080d60", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--04aa30e6-4de2-56eb-a98f-a03d87f175f7", "toId": "79ff1a9e-429a-4d0d-b2f6-9e38ca7a93aa", "to_id": "79ff1a9e-429a-4d0d-b2f6-9e38ca7a93aa", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.656Z", "created_at": "2026-09-26T02:22:06.086Z", "modified": "2026-09-26T02:22:06.310Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:06.310Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_id": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "from_name": null, "from_type": "Indicator", "id": "e24f4dea-aed4-4150-b8eb-982f5983fcf0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--be1ccbda-baf9-5183-9351-d8bfac243047", "toId": "259cd2d3-0e4a-46bb-b64f-679a8d1abb32", "to_id": "259cd2d3-0e4a-46bb-b64f-679a8d1abb32", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.299Z", "created_at": "2026-09-26T02:34:26.343Z", "modified": "2026-09-26T02:34:26.572Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:26.572Z" }, "description_available": false, "entity_type": "indicates", "fromId": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_id": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "from_name": null, "from_type": "Indicator", "id": "e35cd8f8-a9fb-40e4-af63-7eadb7f0902b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--68808a23-a3ce-5848-85cf-cdca9eef2605", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.467Z", "created_at": "2026-09-26T02:37:28.111Z", "modified": "2026-09-26T02:37:28.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:28.348Z" }, "description_available": false, "entity_type": "indicates", "fromId": "35638839-e7f8-400f-b53f-151f43a9747e", "from_id": "35638839-e7f8-400f-b53f-151f43a9747e", "from_name": null, "from_type": "Indicator", "id": "e3886ae3-bbf6-4848-a256-c4774c80b9eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d4d74f4d-6cd2-5952-a91d-8688e1c41aff", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.884Z", "created_at": "2026-09-26T02:26:24.996Z", "modified": "2026-09-26T02:26:25.286Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:25.286Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_id": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_name": null, "from_type": "Indicator", "id": "e42bc045-5c90-4814-9285-579901c5763e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--84be3e0a-7490-5ba2-8306-2a1dad9e3aa0", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.670Z", "created_at": "2026-09-26T02:22:11.269Z", "modified": "2026-09-26T02:22:11.740Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:11.740Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_id": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "from_name": null, "from_type": "Indicator", "id": "e487cf43-bc82-4588-8d7a-5360eaf35b3e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8b46d760-f9cd-53fe-86ec-2eba2e8c9515", "toId": "3e3c8219-b4e4-479f-9107-ceac88643e9d", "to_id": "3e3c8219-b4e4-479f-9107-ceac88643e9d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.749Z", "created_at": "2026-09-26T02:46:44.746Z", "modified": "2026-09-26T02:46:44.962Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:46:44.962Z" }, "description_available": false, "entity_type": "indicates", "fromId": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_id": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "from_name": null, "from_type": "Indicator", "id": "e49b8e87-1eb7-4243-8d1d-64fdf29dc306", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d7b0dcac-2825-5fb4-ae84-0770e4437189", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.994Z", "created_at": "2026-09-26T02:28:15.209Z", "modified": "2026-09-26T02:28:15.343Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:28:15.343Z" }, "description_available": false, "entity_type": "indicates", "fromId": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_id": "88c5ae80-667a-4ac3-be7a-18af7e81f683", "from_name": null, "from_type": "Indicator", "id": "e4b0bf9a-e185-40fe-8fd5-6a5d533cf069", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--98559869-233c-527c-b4a0-707f1b9e550b", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.683Z", "created_at": "2026-09-26T02:42:47.798Z", "modified": "2026-09-26T02:42:47.960Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:47.960Z" }, "description_available": false, "entity_type": "indicates", "fromId": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_id": "36bb0d37-a840-4c1e-90f4-cbdaf8e89207", "from_name": null, "from_type": "Indicator", "id": "e55c0e27-099e-4125-a7f1-38373279e674", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--83fa2887-dc41-5658-b67c-4207b0e905e1", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.746Z", "created_at": "2026-09-26T02:22:24.459Z", "modified": "2026-09-26T02:22:24.794Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:24.794Z" }, "description_available": false, "entity_type": "based-on", "fromId": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_id": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "from_name": null, "from_type": "Indicator", "id": "e5762fd6-b106-434b-943c-11ca30dac45d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b21e37ac-02d6-5a1b-b5b5-fe13a959195e", "toId": "e4f6be0b-7b68-444c-b386-aed034c5e4ab", "to_id": "e4f6be0b-7b68-444c-b386-aed034c5e4ab", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.649Z", "created_at": "2026-09-26T02:22:03.725Z", "modified": "2026-09-26T02:22:04.362Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:04.362Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_id": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_name": null, "from_type": "Indicator", "id": "e6812642-afa0-4ffc-a8a7-0fb22377f2d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f31b8635-09fd-543f-84f2-127fd489007c", "toId": "a3d00dbe-8076-4925-aaa0-beef5349d0e7", "to_id": "a3d00dbe-8076-4925-aaa0-beef5349d0e7", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.189Z", "created_at": "2026-09-26T02:30:34.814Z", "modified": "2026-09-26T02:30:35.386Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:35.386Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_id": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "from_name": null, "from_type": "Indicator", "id": "e7224f48-8913-47df-b3f2-36ad9acb7ecf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--38faf78a-e81e-5e22-83b6-db92d9162fde", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.344Z", "created_at": "2026-09-26T02:35:14.494Z", "modified": "2026-09-26T02:35:14.649Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:14.649Z" }, "description_available": false, "entity_type": "indicates", "fromId": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_id": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "from_name": null, "from_type": "Indicator", "id": "e725d68d-1a4f-498c-9ef0-28c1e5221e0f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4026c7d4-9e82-594d-9c19-ae087b9053e9", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.718Z", "created_at": "2026-09-26T02:22:20.669Z", "modified": "2026-09-26T02:22:21.043Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:21.043Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_id": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_name": null, "from_type": "Indicator", "id": "e75ddbac-e7fa-4ce3-87c0-69099adb08fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4fac3a55-9223-5619-b1aa-10cc454ed4ec", "toId": "576a1cda-087b-4df2-b8d3-6b179cbd7a18", "to_id": "576a1cda-087b-4df2-b8d3-6b179cbd7a18", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.565Z", "created_at": "2026-09-26T02:21:10.097Z", "modified": "2026-09-26T02:21:10.356Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:10.356Z" }, "description_available": false, "entity_type": "targets", "fromId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_name": "BlueMoon", "from_type": "Malware", "id": "e7ac26a3-ce8a-4e57-96ed-b54848e09e20", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1f9fd8e0-84d9-50a9-94b6-0717d3e635e6", "toId": "4458b114-0fe4-4d79-beea-3b281c045e08", "to_id": "4458b114-0fe4-4d79-beea-3b281c045e08", "to_name": "CVE-2026-85880", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.374Z", "created_at": "2026-09-26T02:35:41.987Z", "modified": "2026-09-26T02:35:43.316Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:35:43.316Z" }, "description_available": false, "entity_type": "indicates", "fromId": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_id": "899bea10-a43c-4db4-b883-acb51ee48ca3", "from_name": null, "from_type": "Indicator", "id": "e7f39b6c-75fb-439d-a5c4-01fdd3d38f09", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4baf9228-d99f-584d-acad-8c35300f78c1", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.171Z", "created_at": "2026-09-26T02:30:16.653Z", "modified": "2026-09-26T02:30:16.862Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:16.862Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_id": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "from_name": null, "from_type": "Indicator", "id": "e90aaf7c-4765-45a6-b3fb-0b2a535c6a59", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d6afd176-d0d9-5cf8-9e6c-9a97d07db59c", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.312Z", "created_at": "2026-09-26T02:34:43.579Z", "modified": "2026-09-26T02:34:43.794Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:34:43.794Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_id": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "from_name": null, "from_type": "Indicator", "id": "eb004477-59d6-4f1b-b6c1-598046bb6159", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--dcbe6221-a6c4-593a-b003-2d1d8b4eadd6", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.441Z", "created_at": "2026-09-26T02:36:44.883Z", "modified": "2026-09-26T02:36:45.717Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:45.717Z" }, "description_available": false, "entity_type": "indicates", "fromId": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_id": "908266a0-28c7-44da-97f2-c59ac89fc02d", "from_name": null, "from_type": "Indicator", "id": "ec3e310d-1b7a-4107-ac16-650a56c06e2d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f957bae8-95c6-558e-a252-495696bb5653", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.763Z", "created_at": "2026-09-26T02:46:59.797Z", "modified": "2026-09-26T02:47:00.088Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:47:00.088Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_id": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "from_name": null, "from_type": "Indicator", "id": "ecf6499e-aead-4e94-a478-2966d37a4815", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--7ab52e9e-f386-568a-a6f6-4bb5d01d1a16", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.157Z", "created_at": "2026-09-26T02:30:03.983Z", "modified": "2026-09-26T02:30:04.361Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:04.361Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_id": "2246fa10-784d-46a8-9813-e48a9c264f7b", "from_name": null, "from_type": "Indicator", "id": "edfb16e4-bec1-43ed-9ebb-e0cce76d8d06", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5f975ad2-0013-5c7d-b9a6-cd5e34fee568", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.644Z", "created_at": "2026-09-26T02:42:05.759Z", "modified": "2026-09-26T02:42:06.163Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:42:06.163Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5362aa72-f60c-4284-807f-56610dba2887", "from_id": "5362aa72-f60c-4284-807f-56610dba2887", "from_name": null, "from_type": "Indicator", "id": "efda06a7-4bd4-45bd-91c0-611bb93e3311", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--c806235f-bb88-54cb-8c45-138c1979af9b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.791Z", "created_at": "2026-09-26T02:49:12.339Z", "modified": "2026-09-26T02:49:13.419Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:49:13.419Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_id": "fea856af-2fca-4d0a-8c0c-0ab3a29dd7e5", "from_name": null, "from_type": "Indicator", "id": "f024f9e0-159f-421d-8c58-19c3348c52e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--60d56dd5-6865-5c88-8671-2e347c66942a", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.608Z", "created_at": "2026-09-26T02:41:26.614Z", "modified": "2026-09-26T02:41:27.299Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:27.299Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_id": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "from_name": null, "from_type": "Indicator", "id": "f3c0d38b-fef9-42c6-88ad-1745f9612b38", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--6e4d6aa1-b81d-549d-b134-2a8a90665b8e", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.653Z", "created_at": "2026-09-26T02:22:06.093Z", "modified": "2026-09-26T02:22:06.398Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:06.398Z" }, "description_available": false, "entity_type": "based-on", "fromId": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_id": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "from_name": null, "from_type": "Indicator", "id": "f4572b13-7f40-4a04-983b-f6b7d48c06b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8e8c1566-c94f-5196-877a-acc8af7ca423", "toId": "1ef6c578-25f9-4fb3-9485-c7f5cbcc2d3f", "to_id": "1ef6c578-25f9-4fb3-9485-c7f5cbcc2d3f", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.480Z", "created_at": "2026-09-26T02:37:40.234Z", "modified": "2026-09-26T02:37:40.652Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:37:40.652Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_id": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "from_name": null, "from_type": "Indicator", "id": "f46e3883-9bdf-4e41-ba59-744d8257e136", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--e6040201-d039-59b9-b863-739ec1de4a60", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.723Z", "created_at": "2026-09-26T02:45:43.107Z", "modified": "2026-09-26T02:45:43.815Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:45:43.815Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_id": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "from_name": null, "from_type": "Indicator", "id": "f563b8d1-48a0-4e1b-9d9d-e7ccab99c210", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--8eb21a0b-9b89-531e-9b04-bb60add0239b", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.818Z", "created_at": "2026-09-26T02:50:27.226Z", "modified": "2026-09-26T02:50:27.797Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:50:27.797Z" }, "description_available": false, "entity_type": "indicates", "fromId": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_id": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_name": null, "from_type": "Indicator", "id": "f63a1d7f-3a0a-41c2-bb86-f7826e2997c2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--cfc03d27-e4e9-58af-bfbd-e7a6266e07d4", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.762Z", "created_at": "2026-09-26T02:22:27.923Z", "modified": "2026-09-26T02:22:29.238Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:29.238Z" }, "description_available": false, "entity_type": "based-on", "fromId": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_id": "322d5ef5-edf0-4378-9ca3-8586882f8689", "from_name": null, "from_type": "Indicator", "id": "f6fc5221-1f75-4f82-b025-26b56c45cf47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--d3067ee7-cb79-53a8-a528-bb4e29d7ba44", "toId": "897e57c8-32c1-4472-8a12-9cbe3b53a2b2", "to_id": "897e57c8-32c1-4472-8a12-9cbe3b53a2b2", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.546Z", "created_at": "2026-09-26T02:40:24.199Z", "modified": "2026-09-26T02:40:24.468Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:40:24.468Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_id": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_name": null, "from_type": "Indicator", "id": "f759a698-edb6-44f7-b894-f18266a7e197", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--3c24bc1d-51db-5e5f-94c6-0dd44c28526f", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.778Z", "created_at": "2026-09-26T02:48:48.364Z", "modified": "2026-09-26T02:48:48.624Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:48:48.624Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_id": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "from_name": null, "from_type": "Indicator", "id": "f76178ea-3f9b-4d49-83fe-e070356c2719", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--0cde0586-ffe4-5e03-96af-07f6efcc8c23", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.710Z", "created_at": "2026-09-26T02:22:19.877Z", "modified": "2026-09-26T02:22:20.149Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:20.149Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_id": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "from_name": null, "from_type": "Indicator", "id": "f762a590-59e3-45e5-ab97-ad1d9fd7f168", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--36edbac7-7310-511f-afd6-53875c13fd92", "toId": "aaf6b22a-1e70-4626-8dec-f9b21f66fd42", "to_id": "aaf6b22a-1e70-4626-8dec-f9b21f66fd42", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.964Z", "created_at": "2026-09-26T02:54:44.420Z", "modified": "2026-09-26T02:54:45.108Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:54:45.108Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_id": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "from_name": null, "from_type": "Indicator", "id": "f790d7ae-5196-471c-b759-2b711e0a987b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--41735b9f-6704-59af-8737-15c23e1231b4", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.788Z", "created_at": "2026-09-26T02:22:33.301Z", "modified": "2026-09-26T02:22:34.693Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:34.693Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_id": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "from_name": null, "from_type": "Indicator", "id": "f8dfdcfb-96df-4d4a-be29-d9d2edb85587", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--4f079371-4348-5c30-86d7-7f2fca8e7ffc", "toId": "8e8f664d-e6b1-4b13-a8ae-3e8bd9619e52", "to_id": "8e8f664d-e6b1-4b13-a8ae-3e8bd9619e52", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.885Z", "created_at": "2026-09-26T02:26:21.786Z", "modified": "2026-09-26T02:26:23.353Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:26:23.353Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_id": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "from_name": null, "from_type": "Indicator", "id": "f8e11d11-241a-4eb0-94fb-ced919c7cef8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--a33d470d-dd93-5d21-b385-8905ba554f92", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.887Z", "created_at": "2026-09-26T02:53:42.308Z", "modified": "2026-09-26T02:53:42.529Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:53:42.529Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_id": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "from_name": null, "from_type": "Indicator", "id": "f8ffe1d2-d5ac-462f-9012-ff81e1d8bd37", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b33e8148-e91f-5c28-9a65-c21752391712", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.406Z", "created_at": "2026-09-26T02:36:10.119Z", "modified": "2026-09-26T02:36:12.073Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:36:12.073Z" }, "description_available": false, "entity_type": "indicates", "fromId": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_id": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "from_name": null, "from_type": "Indicator", "id": "f90f2688-cc1a-44ca-b321-681772608e5b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--5b759987-7fd8-54c3-833e-812ed24d5f74", "toId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "to_name": "GemStone", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.663Z", "created_at": "2026-09-26T02:22:07.786Z", "modified": "2026-09-26T02:22:09.950Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:09.950Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_id": "2544bc40-2f3a-4168-998a-305476eabfbe", "from_name": null, "from_type": "Indicator", "id": "f914d327-29bd-4414-8b1a-2f8b8d88141f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--b8911067-8282-5b83-b0e8-4dd8971cd808", "toId": "68f15535-f7a0-469d-a28a-d76753faccf2", "to_id": "68f15535-f7a0-469d-a28a-d76753faccf2", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.592Z", "created_at": "2026-09-26T02:21:50.673Z", "modified": "2026-09-26T02:21:50.886Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:50.886Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_id": "7b853990-6802-4b75-8de1-2be0a39e6536", "from_name": null, "from_type": "Indicator", "id": "faee6143-c830-4ac5-838a-0a39721d9d49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--02b18a67-7310-5463-a980-c92e8062ad91", "toId": "e9275624-f8c9-4dc3-9f18-811a12adc346", "to_id": "e9275624-f8c9-4dc3-9f18-811a12adc346", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.693Z", "created_at": "2026-09-26T02:22:14.991Z", "modified": "2026-09-26T02:22:17.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:22:17.906Z" }, "description_available": false, "entity_type": "based-on", "fromId": "35638839-e7f8-400f-b53f-151f43a9747e", "from_id": "35638839-e7f8-400f-b53f-151f43a9747e", "from_name": null, "from_type": "Indicator", "id": "fbc21a42-7f36-4994-9459-ee808a0be855", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bc15b82f-cbc8-508f-8fe1-478675dfd002", "toId": "1f7879c7-86b7-483c-82a2-6d1641e67bf4", "to_id": "1f7879c7-86b7-483c-82a2-6d1641e67bf4", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.591Z", "created_at": "2026-09-26T02:41:11.796Z", "modified": "2026-09-26T02:41:12.018Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:41:12.018Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_id": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "from_name": null, "from_type": "Indicator", "id": "fbe14686-9099-499c-9eaf-515f3f591171", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--f980549e-e349-569b-aa12-60c111e20515", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.218Z", "created_at": "2026-09-26T02:31:03.464Z", "modified": "2026-09-26T02:31:03.900Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:31:03.900Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_id": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "from_name": null, "from_type": "Indicator", "id": "fbe6f61b-e8b5-42a7-bc0a-8ab1f33065ad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--0940ac76-7f07-5b14-ae2b-f56bfd6ca49d", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.552Z", "created_at": "2026-09-26T02:17:16.571Z", "modified": "2026-09-26T02:17:16.932Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:16.932Z" }, "description_available": false, "entity_type": "targets", "fromId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "from_name": "BlueMoon", "from_type": "Malware", "id": "fc07886f-0212-4f3a-8e76-0740f11f5162", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--bb041ecd-266d-5fba-acb5-c230726f62c1", "toId": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_name": "Manufacturing", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:03.204Z", "created_at": "2026-09-26T02:30:44.336Z", "modified": "2026-09-26T02:30:44.589Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:30:44.589Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_id": "3830d40b-1944-4ae1-a28b-8071959397c5", "from_name": null, "from_type": "Indicator", "id": "fc362c3c-daa2-402c-8830-55862674ee93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--01bf075d-d72d-5184-9059-316abff3561a", "toId": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "to_name": "BlueMoon", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.554Z", "created_at": "2026-09-26T02:17:17.654Z", "modified": "2026-09-26T02:17:18.411Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:17:18.411Z" }, "description_available": false, "entity_type": "targets", "fromId": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "from_name": "GemStone", "from_type": "Malware", "id": "fe012f2b-41f6-440f-b780-a770e2ebf244", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--400cbac4-3fcc-5cd4-be46-02067bc06ffe", "toId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_name": "Air transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:02.603Z", "created_at": "2026-09-26T02:21:52.288Z", "modified": "2026-09-26T02:21:52.840Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T02:21:52.840Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_id": "d3255eff-0896-4e01-b407-e19ec06bae9c", "from_name": null, "from_type": "Indicator", "id": "fe980a74-cc36-4af0-a978-3f6c66a1f510", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--1edf34ba-9698-5086-94cd-180d7300b3fc", "toId": "bafbda59-e819-4f08-90ad-1ad447bd47af", "to_id": "bafbda59-e819-4f08-90ad-1ad447bd47af", "to_name": null, "to_type": "StixFile" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "airindia[.]fit", "description_available": false, "object_id": "0072d61c-6d01-4865-8246-0725c6e54b11", "object_ids": [ "0072d61c-6d01-4865-8246-0725c6e54b11", "93b015db-4a70-4d9b-b462-a41b1aeb0c54" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0072d61c-6d01-4865-8246-0725c6e54b11", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "airindia.fit" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "93b015db-4a70-4d9b-b462-a41b1aeb0c54", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "airindia.fit" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "airindia.fit" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "airliquide[.]lol", "description_available": false, "object_id": "35638839-e7f8-400f-b53f-151f43a9747e", "object_ids": [ "1f7879c7-86b7-483c-82a2-6d1641e67bf4", "35638839-e7f8-400f-b53f-151f43a9747e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "35638839-e7f8-400f-b53f-151f43a9747e", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "airliquide.lol" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "1f7879c7-86b7-483c-82a2-6d1641e67bf4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "airliquide.lol" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "airliquide.lol" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "airproducts[.]ink", "description_available": false, "object_id": "3830d40b-1944-4ae1-a28b-8071959397c5", "object_ids": [ "3830d40b-1944-4ae1-a28b-8071959397c5", "a3d00dbe-8076-4925-aaa0-beef5349d0e7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3830d40b-1944-4ae1-a28b-8071959397c5", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "airproducts.ink" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "a3d00dbe-8076-4925-aaa0-beef5349d0e7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "airproducts.ink" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "airproducts.ink" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "apollohospitals[.]fit", "description_available": false, "object_id": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "object_ids": [ "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "c710d1c7-ba63-4ec5-b172-443637ee9022" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8a54e2be-3fd3-4d12-8333-a359bc6b5266", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "apollohospitals.fit" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "c710d1c7-ba63-4ec5-b172-443637ee9022", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "apollohospitals.fit" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "apollohospitals.fit" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "attcdn[.]com", "description_available": false, "object_id": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "object_ids": [ "83b6823a-45e7-42c1-8865-d839e2f069e1", "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b9f64d00-9308-4a8f-b6c5-565dfb5f3efb", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "attcdn.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "83b6823a-45e7-42c1-8865-d839e2f069e1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "attcdn.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "attcdn.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "aurexdefense[.]online", "description_available": false, "object_id": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "object_ids": [ "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "a9ecaf49-407d-42d8-8fc2-9c0dff497fac" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "69b05a88-13e3-4d1a-993a-96a9c6e57e26", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "aurexdefense.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "a9ecaf49-407d-42d8-8fc2-9c0dff497fac", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "aurexdefense.online" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "aurexdefense.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "bosch-sensortec[.]site", "description_available": false, "object_id": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "object_ids": [ "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "68d8a6cb-a0af-427d-8b9d-ea6b86f1023d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4b6cdd33-aad0-43ed-bbfc-26add55b7355", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "bosch-sensortec.site" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "68d8a6cb-a0af-427d-8b9d-ea6b86f1023d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "bosch-sensortec.site" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "bosch-sensortec.site" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "brianwilli[.]com", "description_available": false, "object_id": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "object_ids": [ "92145f60-35b5-4180-a821-8d1fcc64de69", "bda00f2b-d340-470f-bfdd-cf3727b8c90f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bda00f2b-d340-470f-bfdd-cf3727b8c90f", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "brianwilli.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "92145f60-35b5-4180-a821-8d1fcc64de69", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "brianwilli.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "brianwilli.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "checrity[.]com", "description_available": false, "object_id": "2544bc40-2f3a-4168-998a-305476eabfbe", "object_ids": [ "2544bc40-2f3a-4168-998a-305476eabfbe", "68f15535-f7a0-469d-a28a-d76753faccf2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2544bc40-2f3a-4168-998a-305476eabfbe", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "checrity.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "68f15535-f7a0-469d-a28a-d76753faccf2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "checrity.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "checrity.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cyclokinetics[.]online", "description_available": false, "object_id": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "object_ids": [ "4df2990c-e4dc-457c-9dad-4f8d2a2cb427", "c826e42d-63dc-40e6-bae4-e5e6a0f76104" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c826e42d-63dc-40e6-bae4-e5e6a0f76104", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "cyclokinetics.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "4df2990c-e4dc-457c-9dad-4f8d2a2cb427", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cyclokinetics.online" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "cyclokinetics.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "elixnovorem[.]com", "description_available": false, "object_id": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "object_ids": [ "40b390b3-3161-426e-8605-046ed49959d5", "7a593d52-2cc1-4040-bfc7-2cccc5e547ab" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7a593d52-2cc1-4040-bfc7-2cccc5e547ab", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "elixnovorem.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "40b390b3-3161-426e-8605-046ed49959d5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "elixnovorem.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "elixnovorem.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "emcore[.]ink", "description_available": false, "object_id": "908266a0-28c7-44da-97f2-c59ac89fc02d", "object_ids": [ "893a0a60-708c-4e05-b761-8c87dc4b7486", "908266a0-28c7-44da-97f2-c59ac89fc02d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "908266a0-28c7-44da-97f2-c59ac89fc02d", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "emcore.ink" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "893a0a60-708c-4e05-b761-8c87dc4b7486", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "emcore.ink" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "emcore.ink" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "epsilonsystems[.]net", "description_available": false, "object_id": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "object_ids": [ "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "1ef6c578-25f9-4fb3-9485-c7f5cbcc2d3f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "02c4fbb8-45b6-439b-be0a-6f1088b6d174", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "epsilonsystems.net" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "1ef6c578-25f9-4fb3-9485-c7f5cbcc2d3f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "epsilonsystems.net" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "epsilonsystems.net" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "fracons[.]com", "description_available": false, "object_id": "322d5ef5-edf0-4378-9ca3-8586882f8689", "object_ids": [ "322d5ef5-edf0-4378-9ca3-8586882f8689", "897e57c8-32c1-4472-8a12-9cbe3b53a2b2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "322d5ef5-edf0-4378-9ca3-8586882f8689", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "fracons.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "897e57c8-32c1-4472-8a12-9cbe3b53a2b2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "fracons.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "fracons.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "getaiexo[.]com", "description_available": false, "object_id": "5362aa72-f60c-4284-807f-56610dba2887", "object_ids": [ "1404b049-de33-4250-8426-69f3e5b168df", "5362aa72-f60c-4284-807f-56610dba2887" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5362aa72-f60c-4284-807f-56610dba2887", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "getaiexo.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "1404b049-de33-4250-8426-69f3e5b168df", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "getaiexo.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "getaiexo.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "haloengines[.]net", "description_available": false, "object_id": "39347496-5229-494f-9602-405597e9e186", "object_ids": [ "39347496-5229-494f-9602-405597e9e186", "a782bd25-1b5c-4c7c-8955-fcdc8b283b06" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "39347496-5229-494f-9602-405597e9e186", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "haloengines.net" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "a782bd25-1b5c-4c7c-8955-fcdc8b283b06", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "haloengines.net" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "haloengines.net" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "jetoptera[.]co", "description_available": false, "object_id": "21107844-453c-4c82-8366-9715c47845ee", "object_ids": [ "21107844-453c-4c82-8366-9715c47845ee", "839dc0d9-ef1a-4249-aeed-24dd1a7fdce6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "21107844-453c-4c82-8366-9715c47845ee", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "jetoptera.co" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "839dc0d9-ef1a-4249-aeed-24dd1a7fdce6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "jetoptera.co" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "jetoptera.co" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "joinmacket[.]com", "description_available": false, "object_id": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "object_ids": [ "576a1cda-087b-4df2-b8d3-6b179cbd7a18", "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d46f8f67-4b36-4a0b-9850-e0f7a64c9c39", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "joinmacket.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "576a1cda-087b-4df2-b8d3-6b179cbd7a18", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "joinmacket.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "joinmacket.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "lindes[.]ink", "description_available": false, "object_id": "bad82237-3d91-4def-8766-61d38b70be49", "object_ids": [ "6198de79-85e0-4ab6-adb6-f1dca49a28e0", "bad82237-3d91-4def-8766-61d38b70be49" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bad82237-3d91-4def-8766-61d38b70be49", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "lindes.ink" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "6198de79-85e0-4ab6-adb6-f1dca49a28e0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "lindes.ink" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "lindes.ink" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "msbenefit[.]com", "description_available": false, "object_id": "7b853990-6802-4b75-8de1-2be0a39e6536", "object_ids": [ "7b853990-6802-4b75-8de1-2be0a39e6536", "e9275624-f8c9-4dc3-9f18-811a12adc346" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7b853990-6802-4b75-8de1-2be0a39e6536", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "msbenefit.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "e9275624-f8c9-4dc3-9f18-811a12adc346", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "msbenefit.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "msbenefit.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "openlumakora[.]com", "description_available": false, "object_id": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "object_ids": [ "c76493a8-5da7-43b4-8bae-961abf2b98b3", "d2f9e1d7-362c-4912-8a4a-74ef9e296427" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d2f9e1d7-362c-4912-8a4a-74ef9e296427", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "openlumakora.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "c76493a8-5da7-43b4-8bae-961abf2b98b3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "openlumakora.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "openlumakora.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "precipart[.]ink", "description_available": false, "object_id": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "object_ids": [ "147f5db3-4484-4f3c-867b-970c8d6fb979", "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e131cbd1-7dbb-4a70-ba6e-d2274bb1225b", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "precipart.ink" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "147f5db3-4484-4f3c-867b-970c8d6fb979", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "precipart.ink" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "precipart.ink" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "rocketlabusa[.]ink", "description_available": false, "object_id": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "object_ids": [ "259cd2d3-0e4a-46bb-b64f-679a8d1abb32", "f77ca09c-f138-4cb1-99bd-adbe8461f10c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f77ca09c-f138-4cb1-99bd-adbe8461f10c", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "rocketlabusa.ink" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "259cd2d3-0e4a-46bb-b64f-679a8d1abb32", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "rocketlabusa.ink" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "rocketlabusa.ink" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "secboxes[.]com", "description_available": false, "object_id": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "object_ids": [ "e5dad1ca-bf44-47ea-b552-5355d7c65a2f", "ea773d69-bef5-4eb2-b212-8c0daa3dcca4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ea773d69-bef5-4eb2-b212-8c0daa3dcca4", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "secboxes.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "e5dad1ca-bf44-47ea-b552-5355d7c65a2f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "secboxes.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "secboxes.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "silvustechnologies[.]online", "description_available": false, "object_id": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "object_ids": [ "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "884c37e7-7b29-42fc-be3a-ba2d5ddc16e5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "79af6939-6a8b-4ba1-b1c0-2a1f5c54e800", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "silvustechnologies.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "884c37e7-7b29-42fc-be3a-ba2d5ddc16e5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "silvustechnologies.online" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "silvustechnologies.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "smxtech[.]xyz", "description_available": false, "object_id": "899bea10-a43c-4db4-b883-acb51ee48ca3", "object_ids": [ "899bea10-a43c-4db4-b883-acb51ee48ca3", "cf3f2241-a684-4462-90e6-a7be1d592547" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "899bea10-a43c-4db4-b883-acb51ee48ca3", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "smxtech.xyz" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "cf3f2241-a684-4462-90e6-a7be1d592547", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "smxtech.xyz" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "smxtech.xyz" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "sncorp[.]fit", "description_available": false, "object_id": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "object_ids": [ "3e3c8219-b4e4-479f-9107-ceac88643e9d", "c0d4acc7-c123-4e17-8156-cfae23c5ec46" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c0d4acc7-c123-4e17-8156-cfae23c5ec46", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "sncorp.fit" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "3e3c8219-b4e4-479f-9107-ceac88643e9d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "sncorp.fit" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "sncorp.fit" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "spectrolab[.]fit", "description_available": false, "object_id": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "object_ids": [ "134a3884-e439-4d6a-a889-bace089a0636", "f5b1c3b5-5195-4a3e-948c-3aed8a42079c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f5b1c3b5-5195-4a3e-948c-3aed8a42079c", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "spectrolab.fit" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "134a3884-e439-4d6a-a889-bace089a0636", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "spectrolab.fit" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "spectrolab.fit" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "tcomlp[.]online", "description_available": false, "object_id": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "object_ids": [ "02626825-58bd-4f6f-82ee-ca0f14a520f4", "75a38a71-04ed-4526-95d0-66d4435b1918" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "02626825-58bd-4f6f-82ee-ca0f14a520f4", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "tcomlp.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "75a38a71-04ed-4526-95d0-66d4435b1918", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "tcomlp.online" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "tcomlp.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "v8-ctf-chrome-stage4-handover[.]md", "description_available": false, "object_id": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "object_ids": [ "8e8f664d-e6b1-4b13-a8ae-3e8bd9619e52", "b53b8300-a520-47ec-9b40-3ec4d2dcb0da" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b53b8300-a520-47ec-9b40-3ec4d2dcb0da", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "v8-ctf-chrome-stage4-handover.md" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "8e8f664d-e6b1-4b13-a8ae-3e8bd9619e52", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "v8-ctf-chrome-stage4-handover.md" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "v8-ctf-chrome-stage4-handover.md" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "velodynaity[.]com", "description_available": false, "object_id": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "object_ids": [ "3d665fa0-7683-4e30-8da6-c91cf0f1d680", "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "83f79eb8-9e86-413a-9fc8-5ab67f69d1ad", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "velodynaity.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "3d665fa0-7683-4e30-8da6-c91cf0f1d680", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "velodynaity.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "velodynaity.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "worldview[.]fit", "description_available": false, "object_id": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "object_ids": [ "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "93e44490-3da8-4ef2-9e1d-a6ef233e26f5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8b6bdf7e-7cab-4363-9db9-81e6a5f18f06", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "worldview.fit" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "93e44490-3da8-4ef2-9e1d-a6ef233e26f5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "worldview.fit" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "domain", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-12-21T02:07:43.260Z", "validity_status": "active", "value": "worldview.fit" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1a062f4982564d6d19a76884ce8bcbb6", "description_available": false, "object_id": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "object_ids": [ "96641aba-b03d-47c0-b0f0-18d45e9ff5bb", "d5aa1cf6-645e-4216-9954-c1525ef8ea7a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d5aa1cf6-645e-4216-9954-c1525ef8ea7a", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "1a062f4982564d6d19a76884ce8bcbb6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "96641aba-b03d-47c0-b0f0-18d45e9ff5bb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1a062f4982564d6d19a76884ce8bcbb6" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "md5", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "1a062f4982564d6d19a76884ce8bcbb6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915", "description_available": false, "object_id": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "object_ids": [ "0400826f-b2c0-4aff-acf3-2ec6ccc4a9ca", "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5dff67a2-c3f9-48ea-a5d5-25ec3c286c34", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0400826f-b2c0-4aff-acf3-2ec6ccc4a9ca", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee", "description_available": false, "object_id": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "object_ids": [ "b3827fec-a300-4a70-a9ab-fccbf9570b28", "bbeffa1c-3e6b-4cf3-b27b-3eece4197be7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b3827fec-a300-4a70-a9ab-fccbf9570b28", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "bbeffa1c-3e6b-4cf3-b27b-3eece4197be7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726", "description_available": false, "object_id": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "object_ids": [ "919f15fe-034c-48b6-9e21-0c624dad1ff8", "e4f6be0b-7b68-444c-b386-aed034c5e4ab" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "919f15fe-034c-48b6-9e21-0c624dad1ff8", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e4f6be0b-7b68-444c-b386-aed034c5e4ab", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432", "description_available": false, "object_id": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "object_ids": [ "127bcbba-f38a-49c8-890c-c734acc14afb", "81d483ce-7378-4ea1-8a5a-b6540b8c0e83" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "81d483ce-7378-4ea1-8a5a-b6540b8c0e83", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "127bcbba-f38a-49c8-890c-c734acc14afb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d", "description_available": false, "object_id": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "object_ids": [ "5e10a076-cfa4-406c-b414-239ab3d85b3a", "e9d72176-7d98-4319-bcd5-9291e8d982c2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e9d72176-7d98-4319-bcd5-9291e8d982c2", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5e10a076-cfa4-406c-b414-239ab3d85b3a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d", "description_available": false, "object_id": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "object_ids": [ "6aaf7178-0879-4eb1-be3f-d311f34a3587", "b218769f-9694-4cc8-a2f8-e5102a348bb7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6aaf7178-0879-4eb1-be3f-d311f34a3587", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b218769f-9694-4cc8-a2f8-e5102a348bb7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288", "description_available": false, "object_id": "d3255eff-0896-4e01-b407-e19ec06bae9c", "object_ids": [ "bafbda59-e819-4f08-90ad-1ad447bd47af", "d3255eff-0896-4e01-b407-e19ec06bae9c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d3255eff-0896-4e01-b407-e19ec06bae9c", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "bafbda59-e819-4f08-90ad-1ad447bd47af", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f", "description_available": false, "object_id": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "object_ids": [ "3a8f5384-8175-4b0a-9b19-c6f11c754628", "eb1cc99a-fe28-40f5-97f3-77a33e6b25be" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "eb1cc99a-fe28-40f5-97f3-77a33e6b25be", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "3a8f5384-8175-4b0a-9b19-c6f11c754628", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22", "description_available": false, "object_id": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "object_ids": [ "4ef50a4d-6ad8-4348-930c-e522d9f35756", "b755ca83-8714-4ce4-8dd2-5907570a1461" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4ef50a4d-6ad8-4348-930c-e522d9f35756", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b755ca83-8714-4ce4-8dd2-5907570a1461", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5", "description_available": false, "object_id": "2246fa10-784d-46a8-9813-e48a9c264f7b", "object_ids": [ "2246fa10-784d-46a8-9813-e48a9c264f7b", "95d05541-4dfd-417b-9938-afe603a48f2a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2246fa10-784d-46a8-9813-e48a9c264f7b", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "95d05541-4dfd-417b-9938-afe603a48f2a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141", "description_available": false, "object_id": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "object_ids": [ "54a4c15c-2a7f-4ec3-a5dc-1fffc1ca9a3c", "d583e7af-e5bd-48e5-bdb3-97c5f70184cc" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d583e7af-e5bd-48e5-bdb3-97c5f70184cc", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "54a4c15c-2a7f-4ec3-a5dc-1fffc1ca9a3c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69", "description_available": false, "object_id": "73ab01ce-8793-409b-8d77-693b01e232ac", "object_ids": [ "17305616-ea7d-46c7-b74d-756e1d528ebe", "73ab01ce-8793-409b-8d77-693b01e232ac" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "73ab01ce-8793-409b-8d77-693b01e232ac", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "17305616-ea7d-46c7-b74d-756e1d528ebe", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b", "description_available": false, "object_id": "bfda401c-dab3-403d-9abc-99fe172d3865", "object_ids": [ "89e233b2-a13d-4a8a-9aea-20786f0d9044", "bfda401c-dab3-403d-9abc-99fe172d3865" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bfda401c-dab3-403d-9abc-99fe172d3865", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "89e233b2-a13d-4a8a-9aea-20786f0d9044", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360", "description_available": false, "object_id": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "object_ids": [ "406be21b-1340-4a85-ae2c-f95f004e46a7", "c2dc948d-31e7-43c5-9f9d-b09162f55118" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c2dc948d-31e7-43c5-9f9d-b09162f55118", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "406be21b-1340-4a85-ae2c-f95f004e46a7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004", "description_available": false, "object_id": "dd901a81-11dd-4326-9220-8c317d33c0d1", "object_ids": [ "722948a5-a24a-4935-9d91-4c7d88ed7ee3", "dd901a81-11dd-4326-9220-8c317d33c0d1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "dd901a81-11dd-4326-9220-8c317d33c0d1", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "722948a5-a24a-4935-9d91-4c7d88ed7ee3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7", "description_available": false, "object_id": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "object_ids": [ "aaf6b22a-1e70-4626-8dec-f9b21f66fd42", "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e0fb54a6-b7a5-4911-bb73-d38ae4325f9e", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "aaf6b22a-1e70-4626-8dec-f9b21f66fd42", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b", "description_available": false, "object_id": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "object_ids": [ "99baaaa1-f038-4240-aa79-0ad013198c94", "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b35645c0-c5d3-40b1-9a4f-1b41ef33eb09", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "99baaaa1-f038-4240-aa79-0ad013198c94", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "sha256", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2027-06-26T22:22:19.557Z", "validity_status": "active", "value": "ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/SysPr[.]prx", "description_available": false, "object_id": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "object_ids": [ "6f90eb7f-de7b-4cf4-b400-fc7764e46ceb", "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c2a9d1b5-1b90-406f-acc8-af0b4dd6f02c", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "6f90eb7f-de7b-4cf4-b400-fc7764e46ceb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita[.]dll", "description_available": false, "object_id": "59d5d604-dce0-4819-9e20-9483824295de", "object_ids": [ "59d5d604-dce0-4819-9e20-9483824295de", "8b0a11b5-658b-4e90-a723-9a28f1aebb03" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "59d5d604-dce0-4819-9e20-9483824295de", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "8b0a11b5-658b-4e90-a723-9a28f1aebb03", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita[.]exe", "description_available": false, "object_id": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "object_ids": [ "7c3b12bd-7b05-4192-935f-6e71880b3070", "d52855cf-0b45-48f0-83db-a8c1667ebe03" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d52855cf-0b45-48f0-83db-a8c1667ebe03", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "7c3b12bd-7b05-4192-935f-6e71880b3070", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api-prod[.]secboxes[.]com[:]443/download", "description_available": false, "object_id": "6374cee3-22fc-480b-babc-255ef28c2ad9", "object_ids": [ "6374cee3-22fc-480b-babc-255ef28c2ad9", "aa2428da-1698-4a7d-a12e-45989e024aeb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6374cee3-22fc-480b-babc-255ef28c2ad9", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://api-prod.secboxes.com:443/download" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "aa2428da-1698-4a7d-a12e-45989e024aeb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api-prod.secboxes.com:443/download" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://api-prod.secboxes.com:443/download" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//download[.]secboxes[.]com[:]443/dist[.]zip", "description_available": false, "object_id": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "object_ids": [ "adfde137-8bff-4f27-8c2d-320d0de4f1da", "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f3e590f8-65c2-4cbc-8a74-ee3f809a91e5", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://download.secboxes.com:443/dist.zip" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "adfde137-8bff-4f27-8c2d-320d0de4f1da", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://download.secboxes.com:443/dist.zip" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://download.secboxes.com:443/dist.zip" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//evidence[.]msbenefit[.]com/msgbox[.]exe", "description_available": false, "object_id": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "object_ids": [ "8f41ac2c-e916-4724-b010-f9896e16c1fb", "c1ab6014-5cd4-42ae-8c61-327eb1929e9d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c1ab6014-5cd4-42ae-8c61-327eb1929e9d", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://evidence.msbenefit.com/msgbox.exe" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "8f41ac2c-e916-4724-b010-f9896e16c1fb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://evidence.msbenefit.com/msgbox.exe" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://evidence.msbenefit.com/msgbox.exe" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//homepage[.]brianwilli[.]com/d/", "description_available": false, "object_id": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "object_ids": [ "4d0e460f-4bbe-433e-a324-fc8500e89552", "fa3373bc-3c9c-49e7-a7d2-2809331a512a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fa3373bc-3c9c-49e7-a7d2-2809331a512a", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "4d0e460f-4bbe-433e-a324-fc8500e89552", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://homepage.brianwilli.com/d/" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//homepage[.]brianwilli[.]com/d/85rY[.]dat", "description_available": false, "object_id": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "object_ids": [ "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "cc521352-21dd-488f-bbf6-9b20ac1d1a26" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4d595bb9-2781-41c8-b7e3-7f410c650ee3", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/85rY.dat" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "cc521352-21dd-488f-bbf6-9b20ac1d1a26", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://homepage.brianwilli.com/d/85rY.dat" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/85rY.dat" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//homepage[.]brianwilli[.]com/d/SysPr[.]prx", "description_available": false, "object_id": "fbc204e0-b73d-4c21-b240-532955b5d524", "object_ids": [ "bd54d4ad-ddce-4d25-8584-d692e2f5756d", "fbc204e0-b73d-4c21-b240-532955b5d524" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fbc204e0-b73d-4c21-b240-532955b5d524", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/SysPr.prx" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "bd54d4ad-ddce-4d25-8584-d692e2f5756d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://homepage.brianwilli.com/d/SysPr.prx" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/SysPr.prx" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//homepage[.]brianwilli[.]com/d/calibre-launcher[.]dll", "description_available": false, "object_id": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "object_ids": [ "a8296d14-60fc-4411-bfd6-8016ac7e0322", "fcaef175-855f-44ed-96fd-66d77e3cbf0f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fcaef175-855f-44ed-96fd-66d77e3cbf0f", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/calibre-launcher.dll" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "a8296d14-60fc-4411-bfd6-8016ac7e0322", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://homepage.brianwilli.com/d/calibre-launcher.dll" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/calibre-launcher.dll" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//homepage[.]brianwilli[.]com/d/wint[.]exe", "description_available": false, "object_id": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "object_ids": [ "00827ecb-07b5-4717-9f4e-29cbfced6eb8", "aeb9fe14-6201-4058-a4db-b97d96ff4d55" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "aeb9fe14-6201-4058-a4db-b97d96ff4d55", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/wint.exe" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "00827ecb-07b5-4717-9f4e-29cbfced6eb8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://homepage.brianwilli.com/d/wint.exe" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://homepage.brianwilli.com/d/wint.exe" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//project[.]secboxes[.]com/ChromeUpdate[.]exe", "description_available": false, "object_id": "5b501bee-c49c-41d2-a310-86863ba584cc", "object_ids": [ "5b501bee-c49c-41d2-a310-86863ba584cc", "fbb098b4-67dc-4979-8650-344c43ffd62a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5b501bee-c49c-41d2-a310-86863ba584cc", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://project.secboxes.com/ChromeUpdate.exe" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "fbb098b4-67dc-4979-8650-344c43ffd62a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://project.secboxes.com/ChromeUpdate.exe" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://project.secboxes.com/ChromeUpdate.exe" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//recommendation-letter[.]secboxes[.]com/ChromeUpdate[.]exe", "description_available": false, "object_id": "8a294068-ba4c-44c3-aa84-f37ee494decf", "object_ids": [ "3e7fec84-f94e-4720-b965-aef3172a3563", "8a294068-ba4c-44c3-aa84-f37ee494decf" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8a294068-ba4c-44c3-aa84-f37ee494decf", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://recommendation-letter.secboxes.com/ChromeUpdate.exe" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "3e7fec84-f94e-4720-b965-aef3172a3563", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://recommendation-letter.secboxes.com/ChromeUpdate.exe" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://recommendation-letter.secboxes.com/ChromeUpdate.exe" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//zki0y83[.]msbenefit[.]com[:]443/feed", "description_available": false, "object_id": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "object_ids": [ "622a3c64-719a-4bf2-a389-817b4c1092d5", "868f2276-14fb-41dc-9a60-4e85e9031f2b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "868f2276-14fb-41dc-9a60-4e85e9031f2b", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://zki0y83.msbenefit.com:443/feed" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "622a3c64-719a-4bf2-a389-817b4c1092d5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://zki0y83.msbenefit.com:443/feed" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "type": "url", "valid_from": "2026-09-09T11:12:35.000Z", "valid_until": "2026-09-29T16:47:14.434Z", "validity_status": "revoked", "value": "https://zki0y83.msbenefit.com:443/feed" } ], "mentioned": [ { "confidence": 50, "evidence_id": "df7af48a-19fd-4aa2-9016-33cbe8182d2c", "name": "BlueMoon", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "58c14b3f-2c71-41ef-8d52-c17828f0b721", "name": "GemStone", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "name": "ShadowPad - S0596", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "name": "Civil society", "role": "mentionné", "type": "Sector" }, { "confidence": 100, "evidence_id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "name": "Transport", "role": "mentionné", "type": "Sector" }, { "confidence": 80, "evidence_id": "0be6849f-f89f-4e3d-bc3e-b69203d7d3f4", "name": "CVE-2026-85046", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "4458b114-0fe4-4d79-beea-3b281c045e08", "name": "CVE-2026-85880", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:23:00.252Z", "created_at": "2026-02-06T21:23:37.100Z", "modified": "2026-02-06T21:23:37.477Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-06T21:23:37.477Z" }, "description_available": false, "entity_type": "uses", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "3a0176c0-e1aa-48fe-9c9c-3d10075cf12a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "standard_id": "relationship--34df28a9-90b6-529b-bb30-c99219b158a8", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "3a0176c0-e1aa-48fe-9c9c-3d10075cf12a", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "3a0176c0-e1aa-48fe-9c9c-3d10075cf12a" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "fab79403-9d60-420c-bc87-42b644d12f6d", "name": "ShadowPad - S0596", "type": "Malware" } ] } ], "via_entity": { "id": "fab79403-9d60-420c-bc87-42b644d12f6d", "name": "ShadowPad - S0596", "type": "Malware" } } ], "direct_techniques": [], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T03:53:01Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-09T11:12:35.039Z", "created_at": "2026-09-26T02:56:14.381Z", "modified": "2026-09-26T02:56:29.497Z", "published": "2026-09-09T11:12:35.039Z", "updated_at": "2026-09-26T02:56:29.497Z" }, "description_available": true, "id": "40033971-7fa7-4f04-8b90-56a1d181565d", "is_inferred": false, "labels": [ "bluemoon", "browser-extension", "gemstone", "shadowpad" ], "lang": "en", "name": "Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-09T11:12:35.039Z", "references": [ { "external_id": null, "id": "e19746d5-8976-493d-9cec-377f55705ce8", "source_name": "alien-vault", "url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit" }, { "external_id": "6aa13f23b5ab6aa77a03e1e3", "id": "a2943251-864e-4e38-9dcd-63afae853d29", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa13f23b5ab6aa77a03e1e3" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit" }, "targets": [ { "confidence": 50, "evidence_id": "fe012f2b-41f6-440f-b780-a770e2ebf244", "name": "Air transport", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "dae24b13-5977-4223-b23d-9b2d876205b8", "name": "Finance", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "559f1071-806c-40f0-9eb2-5579add3e41a", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "fc07886f-0212-4f3a-8e76-0740f11f5162", "name": "Manufacturing", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "b560045f-b735-4add-b5d5-f0e496d1bd7d", "name": "Non-Governmental Organizations (NGOs)", "role": "cible déclarée (relation targets)", "type": "Sector" } ], "techniques": [], "vulnerabilities": [ "CVE-2026-85046", "CVE-2026-85880" ] }, "report_id": "40033971-7fa7-4f04-8b90-56a1d181565d", "schema_version": 1, "selected_date": "2026-09-09", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit" }