{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "d778130b-566b-4af5-b2a5-3278b5f885ea", "name": "GrelosGTM", "role": "acteur lié (relation targets)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 0, "deduplicated_iocs": 5, "direct_entities": 24, "direct_relationships": 35, "invalid_iocs": 0, "iocs": 5, "mentioned": 8, "mitre_associated": 0, "mitre_direct": 0, "targets": 5, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 52, "excluded_graph_objects": 140, "graph_complete": true, "graph_objects": 24, "graph_relationships": 35, "mitre_context_complete": true, "source_url": "https://www.group-ib.com/blog/grelosgtm/", "status_as_of": "2026-10-10T06:25:47+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.233Z", "created_at": "2026-09-26T06:53:01.503Z", "modified": "2026-09-26T06:53:16.937Z", "updated_at": "2026-09-26T06:53:16.937Z" }, "description_available": false, "entity_type": "Indicator", "id": "03219e88-c356-4db5-be8e-5b5479979110", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "indicator--ce9ea9da-1257-5f57-90c1-94ceed90cb72", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.111Z", "modified": "2026-01-18T14:36:09.339Z", "updated_at": "2026-01-18T14:36:09.339Z" }, "description_available": false, "entity_type": "Region", "id": "0584d53c-836c-41a4-a732-0edcc5dea653", "is_inferred": false, "labels": [], "lang": "en", "name": "Americas", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0", "type": "Region" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T06:52:52.968Z", "updated_at": "2026-09-26T06:52:53.691Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "0c9d31b1-7be5-4620-914e-5145caa8f92d", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "domain-name--03d9cc52-c93d-51bf-a9f6-365aacf574b8", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T06:52:52.791Z", "updated_at": "2026-09-26T06:52:53.161Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "12e7cc0c-4130-4927-ac79-bbfefc029307", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "domain-name--7ded235f-6117-5869-8330-ad14a593cc1a", "type": "DomainName" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.179Z", "created_at": "2026-09-26T06:52:49.725Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T06:52:49.992Z", "updated_at": "2026-09-26T06:52:49.992Z" }, "description_available": false, "entity_type": "Malware", "id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "is_inferred": false, "labels": [], "lang": "en", "name": "JavaScript sniffer", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "malware--cb94efdb-15a8-5772-b904-2d05cb9187e6", "type": "Malware" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:36:53.793Z", "modified": "2026-01-18T14:36:54.026Z", "updated_at": "2026-01-18T14:36:54.026Z" }, "description_available": false, "entity_type": "Region", "id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "is_inferred": false, "labels": [], "lang": "en", "name": "Western Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--a25f43bf-3e2d-55fe-ba09-c63a210f169d", "type": "Region" }, { "__typename": "Country", "aliases": [ "US", "USA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.034Z", "created_at": "2026-01-18T14:36:25.804Z", "modified": "2026-01-20T20:57:15.092Z", "updated_at": "2026-01-20T20:57:15.092Z" }, "description_available": false, "entity_type": "Country", "id": "3460c7f0-1521-461b-af64-2de060664fb1", "is_inferred": false, "labels": [], "lang": "en", "name": "United States of America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--e79b4cf1-a256-5efa-bc74-c94c7c7ffde0", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.225Z", "created_at": "2026-09-26T06:52:56.894Z", "modified": "2026-09-26T06:53:04.150Z", "updated_at": "2026-09-26T06:53:04.150Z" }, "description_available": false, "entity_type": "Indicator", "id": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "indicator--4186f9cb-60f1-54cc-93ca-2a0ece496820", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:36:24.671Z", "modified": "2026-01-18T14:36:24.965Z", "updated_at": "2026-01-18T14:36:24.965Z" }, "description_available": false, "entity_type": "Region", "id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--713e5fdc-da7b-5735-958d-d7dc664efa7f", "type": "Region" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.178Z", "created_at": "2026-09-26T06:52:49.677Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T06:52:49.991Z", "updated_at": "2026-09-26T06:52:49.991Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "4f092540-1d12-48f2-a2a0-405f189627be", "is_inferred": false, "labels": [], "lang": "en", "name": "GrelosGTM", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "intrusion-set--f759a815-2272-5220-a947-476208eae80d", "type": "IntrusionSet" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T06:52:54.510Z", "updated_at": "2026-09-26T06:52:54.961Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "5ae15387-92f0-412c-be68-18e04413aca8", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "domain-name--e9ddf674-9d01-54b0-8d2a-c410ec35a09b", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T06:52:52.989Z", "updated_at": "2026-09-26T06:52:53.692Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "5ca5f153-b3eb-4c80-b35a-53dbfb27896a", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "domain-name--95d2632a-e0e8-5dc8-9988-216deee115d5", "type": "DomainName" }, { "__typename": "Country", "aliases": [ "BE", "BEL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:36:54.385Z", "modified": "2026-01-26T00:22:07.404Z", "updated_at": "2026-01-26T00:22:07.404Z" }, "description_available": false, "entity_type": "Country", "id": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "is_inferred": false, "labels": [], "lang": "en", "name": "Belgium", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--0fa62f48-e653-5f61-b694-85e268235459", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:36:42.591Z", "modified": "2026-01-18T14:36:42.746Z", "updated_at": "2026-01-18T14:36:42.746Z" }, "description_available": false, "entity_type": "Region", "id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "is_inferred": false, "labels": [], "lang": "en", "name": "Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--2e9ef300-a1ab-5c9f-9297-dde66b71cae2", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.221Z", "created_at": "2026-09-26T06:52:54.997Z", "modified": "2026-09-26T06:53:01.359Z", "updated_at": "2026-09-26T06:53:01.359Z" }, "description_available": false, "entity_type": "Indicator", "id": "7deeddfb-f426-4542-9f68-9c533c707aec", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "indicator--0d01882f-354f-55f9-85dc-5cf7a4fb47ba", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "ICS", "Industrial Control Systems", "Utilities", "industrial" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:12.982Z", "modified": "2026-02-05T15:16:55.400Z", "updated_at": "2026-02-05T15:16:55.400Z" }, "description_available": true, "entity_type": "Sector", "id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "is_inferred": false, "labels": [], "lang": "en", "name": "Manufacturing", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "identity--3b7bc57f-b0b6-5dc2-a816-6406ae1d6da1", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.228Z", "created_at": "2026-09-26T06:52:57.682Z", "modified": "2026-09-26T06:53:07.011Z", "updated_at": "2026-09-26T06:53:07.011Z" }, "description_available": false, "entity_type": "Indicator", "id": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "indicator--1c258187-3097-51eb-8932-f1d502aa6c1f", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Commercial", "Distribution", "Ecommerce", "Retail", "Wholesale", "commerce", "e-commerce" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:13.667Z", "modified": "2026-03-24T16:46:51.749Z", "updated_at": "2026-03-24T16:46:51.749Z" }, "description_available": true, "entity_type": "Sector", "id": "91056407-714a-47ac-b73f-5d9d01d4a220", "is_inferred": false, "labels": [], "lang": "en", "name": "Retail (distribution)", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "identity--a3a1e23d-8249-575e-86d4-2d691b08802d", "type": "Sector" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:36:49.784Z", "modified": "2026-01-18T14:36:49.952Z", "updated_at": "2026-01-18T14:36:49.952Z" }, "description_available": false, "entity_type": "Region", "id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "is_inferred": false, "labels": [], "lang": "en", "name": "Southern Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--702e7644-9f72-56de-a39b-993151d3eaab", "type": "Region" }, { "__typename": "Country", "aliases": [ "IT", "ITA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.058Z", "created_at": "2026-01-18T14:36:51.970Z", "modified": "2026-01-25T19:11:49.346Z", "updated_at": "2026-01-25T19:11:49.346Z" }, "description_available": false, "entity_type": "Country", "id": "c4740bb7-1852-488f-935a-7ac938329773", "is_inferred": false, "labels": [], "lang": "en", "name": "Italy", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--d4fdf10e-4bb7-50d7-8ee3-4186168343d2", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:36:45.082Z", "modified": "2026-01-18T14:36:45.471Z", "updated_at": "2026-01-18T14:36:45.471Z" }, "description_available": false, "entity_type": "Region", "id": "d5563518-7ebb-46ed-a037-525564906cd9", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--47a439b0-ad3d-5a9e-8f6a-5de5a7e76d0b", "type": "Region" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T06:52:54.966Z", "updated_at": "2026-09-26T06:52:55.318Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "df92ea86-3299-42dd-bcba-33e465beb263", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "domain-name--bda899ed-c9fa-5c2b-9fb0-b772fb528cce", "type": "DomainName" }, { "__typename": "Country", "aliases": [ "GB", "GBR" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:36:49.586Z", "modified": "2026-01-21T04:27:12.575Z", "updated_at": "2026-01-21T04:27:12.575Z" }, "description_available": false, "entity_type": "Country", "id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "is_inferred": false, "labels": [], "lang": "en", "name": "United Kingdom of Great Britain and Northern Ireland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "location--66421b20-2d5d-5586-8703-48da4d727028", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.230Z", "created_at": "2026-09-26T06:52:57.777Z", "modified": "2026-09-26T06:53:12.039Z", "updated_at": "2026-09-26T06:53:12.039Z" }, "description_available": false, "entity_type": "Indicator", "id": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "indicator--05f0625e-f9f7-569a-b135-cf5bfbd0141a", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.235Z", "created_at": "2026-09-26T06:53:54.786Z", "modified": "2026-09-26T06:53:55.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:55.464Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7deeddfb-f426-4542-9f68-9c533c707aec", "from_id": "7deeddfb-f426-4542-9f68-9c533c707aec", "from_name": null, "from_type": "Indicator", "id": "131626d5-b7f0-4f2e-8e2b-1f036aa8f29d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--3a74132f-f05a-542a-9e56-819a1587777e", "toId": "4f092540-1d12-48f2-a2a0-405f189627be", "to_id": "4f092540-1d12-48f2-a2a0-405f189627be", "to_name": "GrelosGTM", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.270Z", "created_at": "2026-09-26T06:54:48.528Z", "modified": "2026-09-26T06:54:48.713Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:54:48.713Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "from_id": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "from_name": null, "from_type": "Indicator", "id": "3102ddfd-9d63-49ae-99bd-d49a68ee4ea9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--4448a000-d1f4-5ff4-bc77-ab6340b04b7b", "toId": "4f092540-1d12-48f2-a2a0-405f189627be", "to_id": "4f092540-1d12-48f2-a2a0-405f189627be", "to_name": "GrelosGTM", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:39:38.323Z", "modified": "2026-01-18T14:39:38.509Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:38.509Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "from_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "from_name": "United Kingdom of Great Britain and Northern Ireland", "from_type": "Country", "id": "384f404b-1b13-4e2c-b360-ef51feb026c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--e3cb58c7-3ba5-5f88-b0a8-b69046948322", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.226Z", "created_at": "2026-09-26T06:53:53.115Z", "modified": "2026-09-26T06:53:53.371Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:53.371Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "from_id": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "from_name": null, "from_type": "Indicator", "id": "387be827-8b28-49f3-b208-99318e2ce63f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--fb3e8512-b1a5-5b84-bad6-c4b1302c5f50", "toId": "5ca5f153-b3eb-4c80-b35a-53dbfb27896a", "to_id": "5ca5f153-b3eb-4c80-b35a-53dbfb27896a", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:39:48.201Z", "modified": "2026-01-18T14:39:48.601Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:48.601Z" }, "description_available": true, "entity_type": "located-at", "fromId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "from_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "from_name": "Western Europe", "from_type": "Region", "id": "42e7a8d1-4ff2-49b2-8955-e523f876fd14", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--a8c89c99-5dee-56fe-ab02-c5269d6a6624", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.218Z", "created_at": "2026-09-26T06:53:10.518Z", "modified": "2026-09-26T06:53:11.164Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:11.164Z" }, "description_available": false, "entity_type": "targets", "fromId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_name": "JavaScript sniffer", "from_type": "Malware", "id": "440f620b-f9d2-4120-b51c-b11434995321", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--a7c4be4e-5b2a-5bee-b401-4f688c67dd48", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:38:39.061Z", "modified": "2026-01-18T14:38:39.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:39.335Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_name": "Northern America", "from_type": "Region", "id": "4a3ffcd5-bd03-47c6-a71d-4c47c1151811", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--35fa17bc-cd76-5e88-b582-d1c577aa86ba", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:39:38.396Z", "modified": "2026-01-18T14:39:38.694Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:38.694Z" }, "description_available": true, "entity_type": "located-at", "fromId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "from_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "from_name": "Southern Europe", "from_type": "Region", "id": "4a4ab3f0-da20-43c5-9cef-24ebe8bbf656", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--b8e30f57-1b31-5a56-85c4-71dfc9e4f62a", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.180Z", "created_at": "2026-09-26T06:53:25.892Z", "modified": "2026-09-26T06:53:26.308Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:26.308Z" }, "description_available": false, "entity_type": "uses", "fromId": "4f092540-1d12-48f2-a2a0-405f189627be", "from_id": "4f092540-1d12-48f2-a2a0-405f189627be", "from_name": "GrelosGTM", "from_type": "IntrusionSet", "id": "4fcc1878-8032-4f4a-b54e-f831939f2667", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--476276c1-bc30-58b4-9db8-f4d44dbfaadd", "toId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_name": "JavaScript sniffer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.232Z", "created_at": "2026-09-26T06:53:54.067Z", "modified": "2026-09-26T06:53:54.892Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:54.892Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "from_id": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "from_name": null, "from_type": "Indicator", "id": "5083c8ea-6597-4723-9767-001a7ce017b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--c904a07b-c8ff-56fd-b66d-59b295f97111", "toId": "5ae15387-92f0-412c-be68-18e04413aca8", "to_id": "5ae15387-92f0-412c-be68-18e04413aca8", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.236Z", "created_at": "2026-09-26T06:53:59.206Z", "modified": "2026-09-26T06:53:59.530Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:59.530Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7deeddfb-f426-4542-9f68-9c533c707aec", "from_id": "7deeddfb-f426-4542-9f68-9c533c707aec", "from_name": null, "from_type": "Indicator", "id": "5849b888-6fcf-4bdd-92c2-89d047fe669e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--724f0483-5415-51e0-b67f-04be8a659e3c", "toId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_name": "JavaScript sniffer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.271Z", "created_at": "2026-09-26T06:54:50.020Z", "modified": "2026-09-26T06:54:50.816Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:54:50.816Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "from_id": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "from_name": null, "from_type": "Indicator", "id": "5b479239-90ff-4239-806f-b17a302d1ff9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--4b7f3b1f-ceda-5568-a716-53e412025377", "toId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_name": "JavaScript sniffer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.059Z", "created_at": "2026-01-18T14:39:42.638Z", "modified": "2026-01-18T14:39:42.869Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:42.869Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c4740bb7-1852-488f-935a-7ac938329773", "from_id": "c4740bb7-1852-488f-935a-7ac938329773", "from_name": "Italy", "from_type": "Country", "id": "660538fe-4f60-4d0b-8229-30b49865088b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--c2d18b12-1857-5c6d-8398-d13be81ae366", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.260Z", "created_at": "2026-09-26T06:54:32.124Z", "modified": "2026-09-26T06:54:34.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:54:34.305Z" }, "description_available": false, "entity_type": "indicates", "fromId": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "from_id": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "from_name": null, "from_type": "Indicator", "id": "667976b2-fda7-4b54-a7ff-bf670ca065c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--ff24f4c4-bb02-5e7a-83b3-76d93c710a3d", "toId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_name": "JavaScript sniffer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.246Z", "created_at": "2026-09-26T06:54:13.209Z", "modified": "2026-09-26T06:54:13.792Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:54:13.792Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "from_id": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "from_name": null, "from_type": "Indicator", "id": "7680a379-895a-4583-933e-4ff02bac8bed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--86531101-91ab-5e43-b95d-cbdcf3b046d2", "toId": "4f092540-1d12-48f2-a2a0-405f189627be", "to_id": "4f092540-1d12-48f2-a2a0-405f189627be", "to_name": "GrelosGTM", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.212Z", "created_at": "2026-09-26T06:53:01.654Z", "modified": "2026-09-26T06:53:03.879Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:03.879Z" }, "description_available": false, "entity_type": "targets", "fromId": "4f092540-1d12-48f2-a2a0-405f189627be", "from_id": "4f092540-1d12-48f2-a2a0-405f189627be", "from_name": "GrelosGTM", "from_type": "IntrusionSet", "id": "7d9ac8a1-7567-4b98-b990-a755f673ddcc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--dfd76c29-24b9-5a52-bbbe-4a1e8f31bd8b", "toId": "91056407-714a-47ac-b73f-5d9d01d4a220", "to_id": "91056407-714a-47ac-b73f-5d9d01d4a220", "to_name": "Retail (distribution)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.217Z", "created_at": "2026-09-26T06:53:10.502Z", "modified": "2026-09-26T06:53:11.162Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:11.162Z" }, "description_available": false, "entity_type": "targets", "fromId": "4f092540-1d12-48f2-a2a0-405f189627be", "from_id": "4f092540-1d12-48f2-a2a0-405f189627be", "from_name": "GrelosGTM", "from_type": "IntrusionSet", "id": "877f4361-c5bc-45c6-8545-dac773d8a6f0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--77925cea-25c1-5b43-8056-c4936be146cc", "toId": "c4740bb7-1852-488f-935a-7ac938329773", "to_id": "c4740bb7-1852-488f-935a-7ac938329773", "to_name": "Italy", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.218Z", "created_at": "2026-09-26T06:53:07.937Z", "modified": "2026-09-26T06:53:10.107Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:10.107Z" }, "description_available": false, "entity_type": "targets", "fromId": "4f092540-1d12-48f2-a2a0-405f189627be", "from_id": "4f092540-1d12-48f2-a2a0-405f189627be", "from_name": "GrelosGTM", "from_type": "IntrusionSet", "id": "8b4b9b8b-9f45-450f-8aa2-f344dd3d121d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--67b084bb-94de-55b4-b07e-8b5ff0eb0a58", "toId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_name": "United Kingdom of Great Britain and Northern Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.219Z", "created_at": "2026-09-26T06:53:11.886Z", "modified": "2026-09-26T06:53:12.156Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:12.156Z" }, "description_available": false, "entity_type": "targets", "fromId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_name": "JavaScript sniffer", "from_type": "Malware", "id": "8b9f1829-50a5-48d9-af80-45de8c0d01a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--78dd4552-6cb2-5aeb-b9ea-dd0d5d52a486", "toId": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "to_id": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "to_name": "Belgium", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.216Z", "created_at": "2026-09-26T06:53:06.696Z", "modified": "2026-09-26T06:53:07.196Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:07.196Z" }, "description_available": false, "entity_type": "targets", "fromId": "4f092540-1d12-48f2-a2a0-405f189627be", "from_id": "4f092540-1d12-48f2-a2a0-405f189627be", "from_name": "GrelosGTM", "from_type": "IntrusionSet", "id": "a1accd9d-c449-499a-ba33-54216083e0ed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--511acf81-49ef-5f28-96fb-306374303f5a", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.283Z", "created_at": "2026-09-26T06:55:03.165Z", "modified": "2026-09-26T06:55:03.368Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:55:03.368Z" }, "description_available": false, "entity_type": "indicates", "fromId": "03219e88-c356-4db5-be8e-5b5479979110", "from_id": "03219e88-c356-4db5-be8e-5b5479979110", "from_name": null, "from_type": "Indicator", "id": "a7e97652-a2e9-4b0d-a1fc-3dd58c5c9921", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--7c92d215-e13a-5ccc-8d63-89e849146e88", "toId": "4f092540-1d12-48f2-a2a0-405f189627be", "to_id": "4f092540-1d12-48f2-a2a0-405f189627be", "to_name": "GrelosGTM", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.284Z", "created_at": "2026-09-26T06:55:03.657Z", "modified": "2026-09-26T06:55:06.072Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:55:06.072Z" }, "description_available": false, "entity_type": "indicates", "fromId": "03219e88-c356-4db5-be8e-5b5479979110", "from_id": "03219e88-c356-4db5-be8e-5b5479979110", "from_name": null, "from_type": "Indicator", "id": "b2e55ed8-b8bd-4974-9d76-dff55b21ac3e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--4f43c03c-7f67-5354-a779-f3e8f8e1d3e0", "toId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_name": "JavaScript sniffer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:34.859Z", "modified": "2026-01-18T14:35:35.083Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:35:35.083Z" }, "description_available": true, "entity_type": "part-of", "fromId": "91056407-714a-47ac-b73f-5d9d01d4a220", "from_id": "91056407-714a-47ac-b73f-5d9d01d4a220", "from_name": "Retail (distribution)", "from_type": "Sector", "id": "ba52f2c9-5233-440f-bef8-6a15d290bc38", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "part-of", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--5fc33e30-9815-5b29-bce2-05c44ca9155f", "toId": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_name": "Manufacturing", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.234Z", "created_at": "2026-09-26T06:53:54.691Z", "modified": "2026-09-26T06:53:55.259Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:55.259Z" }, "description_available": false, "entity_type": "based-on", "fromId": "03219e88-c356-4db5-be8e-5b5479979110", "from_id": "03219e88-c356-4db5-be8e-5b5479979110", "from_name": null, "from_type": "Indicator", "id": "bf5fcb04-e82f-4967-8141-e592c5d29517", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--4b58720e-7350-5fd2-aee9-755313ad997c", "toId": "df92ea86-3299-42dd-bcba-33e465beb263", "to_id": "df92ea86-3299-42dd-bcba-33e465beb263", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.220Z", "created_at": "2026-09-26T06:53:16.824Z", "modified": "2026-09-26T06:53:19.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:19.101Z" }, "description_available": false, "entity_type": "targets", "fromId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_name": "JavaScript sniffer", "from_type": "Malware", "id": "c4920bb9-2cef-4554-a7ae-02c4f9982d91", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--3860c054-1cb9-5a7b-a1f1-0cb580020775", "toId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_name": "United Kingdom of Great Britain and Northern Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.260Z", "created_at": "2026-09-26T06:54:30.448Z", "modified": "2026-09-26T06:54:30.687Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:54:30.687Z" }, "description_available": false, "entity_type": "indicates", "fromId": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "from_id": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "from_name": null, "from_type": "Indicator", "id": "c78546a3-20f2-474b-b979-17420532b18d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--54a0825a-0959-575f-ace3-ff300d35f76e", "toId": "4f092540-1d12-48f2-a2a0-405f189627be", "to_id": "4f092540-1d12-48f2-a2a0-405f189627be", "to_name": "GrelosGTM", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.247Z", "created_at": "2026-09-26T06:54:21.576Z", "modified": "2026-09-26T06:54:21.994Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:54:21.994Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "from_id": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "from_name": null, "from_type": "Indicator", "id": "d1a90ed1-d64d-43db-90c0-6dcae4dd81be", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--57c88b90-3493-55fc-bb81-1535c2e5b052", "toId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "to_name": "JavaScript sniffer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:39:50.718Z", "modified": "2026-01-18T14:39:51.264Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:51.264Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "from_id": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "from_name": "Belgium", "from_type": "Country", "id": "d6cc3c74-c275-4e36-a2f9-5e60ec862c80", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--9fd0e702-c9dc-5f2f-97d6-a24fd3e0c19a", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.217Z", "created_at": "2026-09-26T06:53:21.398Z", "modified": "2026-09-26T06:53:23.088Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:23.088Z" }, "description_available": false, "entity_type": "targets", "fromId": "4f092540-1d12-48f2-a2a0-405f189627be", "from_id": "4f092540-1d12-48f2-a2a0-405f189627be", "from_name": "GrelosGTM", "from_type": "IntrusionSet", "id": "d778130b-566b-4af5-b2a5-3278b5f885ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--e2697342-8e45-5de1-ba93-468143d45d0e", "toId": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "to_id": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "to_name": "Belgium", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:38:41.111Z", "modified": "2026-01-18T14:38:41.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:41.841Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3460c7f0-1521-461b-af64-2de060664fb1", "from_id": "3460c7f0-1521-461b-af64-2de060664fb1", "from_name": "United States of America", "from_type": "Country", "id": "daee60ed-495b-4626-8967-6a667c789917", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--98d1ce2f-0759-5c90-a6e9-100a3a2299a7", "toId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_name": "Northern America", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.213Z", "created_at": "2026-09-26T06:53:05.044Z", "modified": "2026-09-26T06:53:06.228Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:06.228Z" }, "description_available": false, "entity_type": "targets", "fromId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_name": "JavaScript sniffer", "from_type": "Malware", "id": "dc30ada0-81ef-480f-8c0e-70d1c2e495f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--075434fb-30d6-50cb-8ccb-e846dbc8a7ea", "toId": "91056407-714a-47ac-b73f-5d9d01d4a220", "to_id": "91056407-714a-47ac-b73f-5d9d01d4a220", "to_name": "Retail (distribution)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.223Z", "created_at": "2026-09-26T06:53:52.200Z", "modified": "2026-09-26T06:53:52.405Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:52.405Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7deeddfb-f426-4542-9f68-9c533c707aec", "from_id": "7deeddfb-f426-4542-9f68-9c533c707aec", "from_name": null, "from_type": "Indicator", "id": "e3f94826-2ced-472c-9e26-97d63ff5d0a9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--309a0515-9087-5168-bd8e-64c66e87ef08", "toId": "12e7cc0c-4130-4927-ac79-bbfefc029307", "to_id": "12e7cc0c-4130-4927-ac79-bbfefc029307", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.229Z", "created_at": "2026-09-26T06:53:53.282Z", "modified": "2026-09-26T06:53:53.835Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:53.835Z" }, "description_available": false, "entity_type": "based-on", "fromId": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "from_id": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "from_name": null, "from_type": "Indicator", "id": "ec2aa4d9-ebf8-4494-8941-dca32c35ac13", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--07656b0b-5cc8-56f9-a733-fc0e319f95cb", "toId": "0c9d31b1-7be5-4620-914e-5145caa8f92d", "to_id": "0c9d31b1-7be5-4620-914e-5145caa8f92d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:47.219Z", "created_at": "2026-09-26T06:53:12.957Z", "modified": "2026-09-26T06:53:13.589Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:53:13.589Z" }, "description_available": false, "entity_type": "targets", "fromId": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "from_name": "JavaScript sniffer", "from_type": "Malware", "id": "f0796c41-fe76-41bd-9120-8d3375174faa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--0c16f787-e9d3-520e-a6a3-b51f76e6242c", "toId": "c4740bb7-1852-488f-935a-7ac938329773", "to_id": "c4740bb7-1852-488f-935a-7ac938329773", "to_name": "Italy", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:39:26.819Z", "modified": "2026-01-18T14:39:27.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:27.423Z" }, "description_available": true, "entity_type": "located-at", "fromId": "d5563518-7ebb-46ed-a037-525564906cd9", "from_id": "d5563518-7ebb-46ed-a037-525564906cd9", "from_name": "Northern Europe", "from_type": "Region", "id": "fdcf6f17-867b-42f3-aecc-004afc94a3a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.group-ib.com/blog/grelosgtm/", "standard_id": "relationship--44bf8f8f-17e0-5590-93ed-b598e74291a6", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "bulder[.]online", "description_available": false, "object_id": "03219e88-c356-4db5-be8e-5b5479979110", "object_ids": [ "03219e88-c356-4db5-be8e-5b5479979110", "df92ea86-3299-42dd-bcba-33e465beb263" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "03219e88-c356-4db5-be8e-5b5479979110", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "bulder.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "df92ea86-3299-42dd-bcba-33e465beb263", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "bulder.online" } ], "source_url": "https://www.group-ib.com/blog/grelosgtm/", "type": "domain", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "bulder.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "fountm[.]online", "description_available": false, "object_id": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "object_ids": [ "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "5ca5f153-b3eb-4c80-b35a-53dbfb27896a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3a37abe5-e5ec-4cfd-ad6e-0222c3300d8e", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "fountm.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "5ca5f153-b3eb-4c80-b35a-53dbfb27896a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "fountm.online" } ], "source_url": "https://www.group-ib.com/blog/grelosgtm/", "type": "domain", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "fountm.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "gstatcs[.]com", "description_available": false, "object_id": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "object_ids": [ "0c9d31b1-7be5-4620-914e-5145caa8f92d", "90e8ea27-decf-44c4-9fd6-259cc6db859e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "90e8ea27-decf-44c4-9fd6-259cc6db859e", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "gstatcs.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "0c9d31b1-7be5-4620-914e-5145caa8f92d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "gstatcs.com" } ], "source_url": "https://www.group-ib.com/blog/grelosgtm/", "type": "domain", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "gstatcs.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "jqwereid[.]online", "description_available": false, "object_id": "7deeddfb-f426-4542-9f68-9c533c707aec", "object_ids": [ "12e7cc0c-4130-4927-ac79-bbfefc029307", "7deeddfb-f426-4542-9f68-9c533c707aec" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7deeddfb-f426-4542-9f68-9c533c707aec", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "jqwereid.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "12e7cc0c-4130-4927-ac79-bbfefc029307", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "jqwereid.online" } ], "source_url": "https://www.group-ib.com/blog/grelosgtm/", "type": "domain", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "jqwereid.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "webfaset[.]com", "description_available": false, "object_id": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "object_ids": [ "5ae15387-92f0-412c-be68-18e04413aca8", "fa1ac30e-1953-4250-8ae7-9e181c4486dc" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fa1ac30e-1953-4250-8ae7-9e181c4486dc", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "webfaset.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "5ae15387-92f0-412c-be68-18e04413aca8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "webfaset.com" } ], "source_url": "https://www.group-ib.com/blog/grelosgtm/", "type": "domain", "valid_from": "2026-09-15T08:15:43.000Z", "valid_until": "2026-12-26T23:10:51.260Z", "validity_status": "active", "value": "webfaset.com" } ], "mentioned": [ { "confidence": 50, "evidence_id": "13ccc2cf-4c8c-4409-9976-46b31de88ac3", "name": "JavaScript sniffer", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "name": "Americas", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "name": "Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "name": "Northern America", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "d5563518-7ebb-46ed-a037-525564906cd9", "name": "Northern Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "name": "Southern Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "name": "Western Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "name": "Manufacturing", "role": "mentionné", "type": "Sector" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-15T08:15:42.502Z", "created_at": "2026-09-26T06:55:20.942Z", "modified": "2026-09-26T06:55:54.280Z", "published": "2026-09-15T08:15:42.502Z", "updated_at": "2026-09-26T06:55:54.280Z" }, "description_available": true, "id": "5276f1fe-7cb9-42bc-b672-17af0bf3abd5", "is_inferred": false, "labels": [ "e-commerce attacks", "google tag manager abuse", "javascript sniffer", "magento cms", "web skimming", "websocket injector" ], "lang": "en", "name": "GrelosGTM group abuses Google Tag Manager to attack e-commerce websites", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-15T08:15:42.502Z", "references": [ { "external_id": null, "id": "c08e9463-b8b8-4145-ae5e-2dbc920c6bd2", "source_name": "alien-vault", "url": "https://www.group-ib.com/blog/grelosgtm/" }, { "external_id": "6aa8feaea12952dc69b265df", "id": "0a3600f1-7b7b-429f-9b99-1a0f9d65fb78", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa8feaea12952dc69b265df" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.group-ib.com/blog/grelosgtm/" }, "targets": [ { "confidence": 50, "evidence_id": "d778130b-566b-4af5-b2a5-3278b5f885ea", "name": "Belgium", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "f0796c41-fe76-41bd-9120-8d3375174faa", "name": "Italy", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "dc30ada0-81ef-480f-8c0e-70d1c2e495f7", "name": "Retail (distribution)", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "c4920bb9-2cef-4554-a7ae-02c4f9982d91", "name": "United Kingdom of Great Britain and Northern Ireland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "a1accd9d-c449-499a-ba33-54216083e0ed", "name": "United States of America", "role": "cible déclarée (relation targets)", "type": "Country" } ], "techniques": [], "vulnerabilities": [] }, "report_id": "5276f1fe-7cb9-42bc-b672-17af0bf3abd5", "schema_version": 1, "selected_date": "2026-09-15", "source_url": "https://www.group-ib.com/blog/grelosgtm/" }