{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "cad7a501-80f1-4440-87fa-bb5993338bb7", "name": "DPRK", "role": "acteur lié (relation uses)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 1, "deduplicated_iocs": 10, "direct_entities": 23, "direct_relationships": 42, "invalid_iocs": 0, "iocs": 10, "mentioned": 2, "mitre_associated": 4, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 228, "excluded_graph_objects": 330, "graph_complete": true, "graph_objects": 23, "graph_relationships": 42, "mitre_context_complete": true, "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "status_as_of": "2026-10-10T10:27:01+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.715Z", "created_at": "2026-09-26T17:45:57.787Z", "modified": "2026-10-08T19:12:05.350Z", "updated_at": "2026-10-08T19:12:05.350Z" }, "description_available": false, "entity_type": "Indicator", "id": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--12ad4df6-3fa6-5c01-8632-e0c882cb04a3", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:51.786Z", "updated_at": "2026-09-26T17:45:52.799Z" }, "description_available": false, "entity_type": "Url", "id": "13dd9fbe-1cc0-4e6d-9c56-f54499d8e7e1", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--25368447-3a0c-5903-ab30-9e032d08707b", "type": "Url" }, { "__typename": "Malware", "aliases": [ "js.otter_cookie" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T17:55:29.115Z", "created_at": "2026-01-18T21:00:18.363Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:13:38.166Z", "updated_at": "2026-10-07T03:13:38.166Z" }, "description_available": true, "entity_type": "Malware", "id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "is_inferred": false, "labels": [ "botnet_cc", "none" ], "lang": "en", "name": "OtterCookie", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "a003a486-00e4-4366-acff-13f55cbd4691", "source_name": "Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025", "url": "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat" }, { "external_id": null, "id": "4eadb693-b794-44cd-837a-d560248408f7", "source_name": "alien-vault", "url": "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html" }, { "external_id": null, "id": "52fb42d3-e156-4326-834d-295d5639730c", "source_name": "malpedia", "url": "https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/" }, { "external_id": null, "id": "a848bc92-08a5-4dc3-9f43-3082138426b4", "source_name": "malpedia", "url": "https://any.run/cybersecurity-blog/lazarus-group-attacks-2025/" }, { "external_id": null, "id": "9bd3f1be-ac10-48d4-8073-a10dfa0b3720", "source_name": "malpedia", "url": "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/" }, { "external_id": null, "id": "7ec6412a-26f1-4fc6-91f5-320056010a48", "source_name": "malpedia", "url": "https://blackpointcyber.com/blog/malicious-node-package-deploys-ottercookie/" }, { "external_id": null, "id": "6a0224d4-677f-4832-9b9b-49431d4404b5", "source_name": "malpedia", "url": "https://blog.daviddodda.com/how-i-almost-got-hacked-by-a-job-interview" }, { "external_id": null, "id": "5a0ec6e7-40ab-49f2-8319-db8f8d981ebb", "source_name": "malpedia", "url": "https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/" }, { "external_id": null, "id": "e3fcb399-038e-4300-9efe-1e50fc231f95", "source_name": "malpedia", "url": "https://blog.talosintelligence.com/beavertail-and-ottercookie/" }, { "external_id": null, "id": "4ca57676-51a0-4c09-acfa-0115b1fbcf81", "source_name": "malpedia", "url": "https://cyberandramen.net/2026/04/04/ottercookie-expands-targeting-to-ai-coding-tools-analysis-of-a-trojanized-npm-campaign/" }, { "external_id": null, "id": "343c8b8a-05cb-4026-aff6-8e7c68809681", "source_name": "malpedia", "url": "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/" }, { "external_id": null, "id": "b9e82467-ee2b-46df-b66d-d4a0daaff520", "source_name": "malpedia", "url": "https://gbhackers.com/lazarus-group-malware-with-ottercookie/" }, { "external_id": null, "id": "88958f67-8a9e-4640-883a-e8222e1205a0", "source_name": "malpedia", "url": "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/" }, { "external_id": null, "id": "457b2bd5-88fe-4bd8-8b07-eb565361ade2", "source_name": "malpedia", "url": "https://jp.security.ntt/insights_resources/tech_blog/en-contagious-interview-ottercookie/" }, { "external_id": null, "id": "25690beb-b479-4a2f-9ecd-bd06bfc19d81", "source_name": "malpedia", "url": "https://jp.security.ntt/insights_resources/tech_blog/en-waterplum-ottercookie/" }, { "external_id": null, "id": "e782a2da-2970-4f99-8f70-1f7df99fc4e5", "source_name": "malpedia", "url": "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie" }, { "external_id": null, "id": "4dd294b9-6174-45aa-b125-153a472f605f", "source_name": "malpedia", "url": "https://jp.security.ntt/tech_blog/en-waterplum-ottercookie" }, { "external_id": null, "id": "9635d6a9-8417-4428-8b0e-c42ce1683206", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/js.otter_cookie" }, { "external_id": null, "id": "f3bcc7a2-7c6b-42c2-8a81-5a82b8560b6f", "source_name": "malpedia", "url": "https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263" }, { "external_id": null, "id": "d51a1b37-04e0-4340-91b7-b100546114c4", "source_name": "malpedia", "url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit" }, { "external_id": null, "id": "18112d8b-4293-4ba8-8050-1dced26523e7", "source_name": "malpedia", "url": "https://panther.com/blog/jsonspack-multi-tenant-node.js-rat-%E2%80%94-dprk-supply-chain-campaign" }, { "external_id": null, "id": "ca91ada9-bfd6-49c9-b5b6-530baddb55fd", "source_name": "malpedia", "url": "https://quetzal.bitso.com/p/interview-with-the-chollima" }, { "external_id": null, "id": "ca5df5b5-1875-4b19-9cf5-9ead3ec7b694", "source_name": "malpedia", "url": "https://redasgard.com/blog/hunting-lazarus-part7-server-not-just-ftp" }, { "external_id": null, "id": "e66dc611-f8ec-460d-95df-5359a72e5eaf", "source_name": "malpedia", "url": "https://research.jfrog.com/post/rollup-polyfill-masquerading/" }, { "external_id": null, "id": "74df00b0-05c3-411f-92d1-7fcfd0fb668e", "source_name": "malpedia", "url": "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" }, { "external_id": null, "id": "32f07402-f8ba-4419-81a0-dfdcdd87438e", "source_name": "malpedia", "url": "https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography" }, { "external_id": null, "id": "67c527eb-024c-4253-b024-436996fb61cb", "source_name": "malpedia", "url": "https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/" }, { "external_id": null, "id": "81da49fb-9157-417b-8f07-ea29bb353dd2", "source_name": "malpedia", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/" }, { "external_id": null, "id": "81496696-24fd-4874-8388-497590c49d9a", "source_name": "malpedia", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/" }, { "external_id": null, "id": "582857b1-4900-45ff-9ae3-d34347507acc", "source_name": "malpedia", "url": "https://www.silentpush.com/blog/contagious-interview-front-companies/" }, { "external_id": null, "id": "33d0cc5e-af3e-4f1a-830d-045d480aafb4", "source_name": "malpedia", "url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf" }, { "external_id": null, "id": "86383930-f13f-4006-9151-276c1a81a268", "source_name": "malpedia", "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "malware--acc69881-708f-5a06-9563-91cf0ee1bf1c", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.728Z", "created_at": "2026-09-26T17:46:01.746Z", "modified": "2026-10-08T19:12:15.412Z", "updated_at": "2026-10-08T19:12:15.412Z" }, "description_available": false, "entity_type": "Indicator", "id": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--3494bccf-f0cb-54e5-ad70-ae988a4aa4a6", "type": "Indicator" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.940Z", "created_at": "2026-02-26T09:42:16.630Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-02-26T09:42:16.962Z", "updated_at": "2026-02-26T09:42:16.962Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "is_inferred": false, "labels": [], "lang": "en", "name": "DPRK", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "intrusion-set--5b635a52-a23d-53a8-8296-dd54ac2e6927", "type": "IntrusionSet" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:54.467Z", "updated_at": "2026-09-26T17:45:55.060Z" }, "description_available": false, "entity_type": "Url", "id": "35ff1ce1-13b8-4b71-a0c4-7a4d29f6ac93", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--487ee2f0-ac30-5265-927e-799d3df1b0da", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.708Z", "created_at": "2026-09-26T17:45:56.368Z", "modified": "2026-09-26T17:46:07.142Z", "updated_at": "2026-09-26T17:46:07.142Z" }, "description_available": false, "entity_type": "Indicator", "id": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--d2800dcb-55d8-5cf8-a16f-aac7e374014a", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:49.093Z", "updated_at": "2026-09-26T17:45:49.915Z" }, "description_available": false, "entity_type": "Url", "id": "3abc185d-a177-4dfa-b79d-303328225d66", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--8544cdc3-3157-53dc-99d9-5e06189bbf42", "type": "Url" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:53.228Z", "updated_at": "2026-09-26T17:45:54.422Z" }, "description_available": false, "entity_type": "Url", "id": "4da99387-da33-493f-bd0a-e4c6ee64940a", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--bd12c91e-2658-5c79-bd3f-9e5cd9816708", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.712Z", "created_at": "2026-09-26T17:45:57.470Z", "modified": "2026-10-08T19:12:18.207Z", "updated_at": "2026-10-08T19:12:18.207Z" }, "description_available": false, "entity_type": "Indicator", "id": "5125945d-5533-463f-a048-0146aba1ab01", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--8b53d883-cc64-566b-bc70-059d8dc27f84", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.724Z", "created_at": "2026-09-26T17:46:00.400Z", "modified": "2026-10-08T19:12:20.324Z", "updated_at": "2026-10-08T19:12:20.324Z" }, "description_available": false, "entity_type": "Indicator", "id": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--8fff0911-4db1-5d34-8f46-054adcdbaa61", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.720Z", "created_at": "2026-09-26T17:46:00.071Z", "modified": "2026-10-08T19:12:12.128Z", "updated_at": "2026-10-08T19:12:12.128Z" }, "description_available": false, "entity_type": "Indicator", "id": "552c49f8-0225-4395-a191-478a27c246c0", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--2d0c64b3-2f39-51b1-801c-f4fdc4ab0560", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:50.597Z", "updated_at": "2026-09-26T17:45:50.981Z" }, "description_available": false, "entity_type": "StixFile", "id": "5e8c4e4c-ca30-4b92-b5bf-e62ac80ab832", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "file--91cfbe6f-0d84-5d58-a614-548024c541e6", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.630Z", "created_at": "2026-09-26T17:45:46.268Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T17:45:46.544Z", "updated_at": "2026-09-26T17:45:46.544Z" }, "description_available": false, "entity_type": "Malware", "id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "is_inferred": false, "labels": [], "lang": "en", "name": "WeaselBiscuit", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "malware--dee40180-b317-5ae8-9a73-d6f6bb2ea3cd", "type": "Malware" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:51.701Z", "updated_at": "2026-09-26T17:45:52.106Z" }, "description_available": false, "entity_type": "Url", "id": "90f2d6ed-545f-4e04-9b34-3727b27b02f8", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--27dd01f3-a52e-52aa-8b0b-84c5ee287e5f", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.726Z", "created_at": "2026-09-26T17:46:00.726Z", "modified": "2026-10-08T19:12:08.338Z", "updated_at": "2026-10-08T19:12:08.338Z" }, "description_available": false, "entity_type": "Indicator", "id": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--198989b4-abe3-5131-a3d6-778866c92ae4", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:55.133Z", "updated_at": "2026-09-26T17:45:55.608Z" }, "description_available": false, "entity_type": "Url", "id": "a6d4d915-70c8-481c-b91a-546b0fea1f0d", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--6f134384-1cde-5464-814e-58f8085e96fd", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.718Z", "created_at": "2026-09-26T17:45:57.947Z", "modified": "2026-10-08T19:12:23.840Z", "updated_at": "2026-10-08T19:12:23.840Z" }, "description_available": false, "entity_type": "Indicator", "id": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--a221c525-0613-5b3b-bd89-d068072fddbe", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:48.918Z", "updated_at": "2026-09-26T17:46:07.093Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "cb8b4429-67a0-4d4c-b027-6ef05f967f92", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "hygiene", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "103.170.217.184", "id": "98d2aa88-0c8c-4d89-a03e-2a66a8427736", "source_name": "Shodan", "url": "https://www.shodan.io/host/103.170.217.184" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "ipv4-addr--52480da7-1fe5-50f0-b061-8e52742d54de", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.701Z", "created_at": "2026-09-26T17:45:55.576Z", "modified": "2026-10-08T19:59:28.387Z", "updated_at": "2026-10-08T19:59:28.387Z" }, "description_available": false, "entity_type": "Indicator", "id": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--ed1138a0-2924-5a7d-968b-94effbfc3047", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:54.624Z", "updated_at": "2026-09-26T17:45:55.153Z" }, "description_available": false, "entity_type": "Url", "id": "d3384abc-8c66-4c5f-9787-6f140a6b08f2", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--811061f8-e9de-5f09-83d2-715c404136d8", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.704Z", "created_at": "2026-09-26T17:45:55.577Z", "modified": "2026-10-08T19:59:28.079Z", "updated_at": "2026-10-08T19:59:28.079Z" }, "description_available": true, "entity_type": "Indicator", "id": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "hygiene", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "indicator--25938781-14bd-5af7-911c-a717a4696e06", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:45:51.209Z", "updated_at": "2026-09-26T17:45:51.469Z" }, "description_available": false, "entity_type": "Url", "id": "ea818d91-785f-437a-927a-d58b6414d8ee", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "url--c27b5223-1acc-5fad-a8ae-b41e96be62a2", "type": "Url" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.902Z", "created_at": "2026-09-26T17:49:36.155Z", "modified": "2026-09-26T17:49:36.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:36.348Z" }, "description_available": false, "entity_type": "indicates", "fromId": "552c49f8-0225-4395-a191-478a27c246c0", "from_id": "552c49f8-0225-4395-a191-478a27c246c0", "from_name": null, "from_type": "Indicator", "id": "0462654a-4eed-4474-854a-02a134146d66", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--61b8a38a-8f26-5f4d-8d44-d46a89b5a434", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.773Z", "created_at": "2026-09-26T17:48:54.626Z", "modified": "2026-09-26T17:48:54.804Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:54.804Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5125945d-5533-463f-a048-0146aba1ab01", "from_id": "5125945d-5533-463f-a048-0146aba1ab01", "from_name": null, "from_type": "Indicator", "id": "08a29212-c205-43ee-a74f-b8a219add67d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--7ab5d9ed-dc30-5042-bfe4-0f3cb731d1a0", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.710Z", "created_at": "2026-09-26T17:47:23.040Z", "modified": "2026-09-26T17:47:27.672Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:27.672Z" }, "description_available": false, "entity_type": "based-on", "fromId": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_id": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_name": null, "from_type": "Indicator", "id": "109afd9d-c52d-4370-9ae4-889db14a2abc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--b35f5f60-4f67-5aac-8f09-598f2820dc42", "toId": "5e8c4e4c-ca30-4b92-b5bf-e62ac80ab832", "to_id": "5e8c4e4c-ca30-4b92-b5bf-e62ac80ab832", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.940Z", "created_at": "2026-09-26T17:50:20.902Z", "modified": "2026-09-26T17:50:21.237Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:50:21.237Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_id": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_name": null, "from_type": "Indicator", "id": "134e66c3-b593-4ac8-89dc-e7b00a3072a2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--6ee3376e-3001-5498-bde4-caf34e74a8e7", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.942Z", "created_at": "2026-09-26T17:50:28.272Z", "modified": "2026-09-26T17:50:28.585Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:50:28.585Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_id": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_name": null, "from_type": "Indicator", "id": "1bfe2674-745e-4350-b648-410737d0b794", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--38b9b52f-070b-5116-8cf8-01489eb536ef", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.757Z", "created_at": "2026-09-26T17:48:39.124Z", "modified": "2026-09-26T17:48:39.310Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:39.310Z" }, "description_available": false, "entity_type": "indicates", "fromId": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_id": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_name": null, "from_type": "Indicator", "id": "2022c1d9-9530-4bd1-8bf0-0860b54e59d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--edbfc23b-2f36-51ad-ba94-7e15f0b46a63", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.759Z", "created_at": "2026-09-26T17:48:40.379Z", "modified": "2026-09-26T17:48:40.577Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:40.577Z" }, "description_available": false, "entity_type": "indicates", "fromId": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_id": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_name": null, "from_type": "Indicator", "id": "2226030e-6209-4252-a0e5-e7ebebef3adf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--21185a7d-6d5e-5c02-a215-c44c5ea615bd", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.719Z", "created_at": "2026-09-26T17:47:36.471Z", "modified": "2026-09-26T17:47:38.208Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:38.208Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_id": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_name": null, "from_type": "Indicator", "id": "27cb74f0-21d1-4d7f-b33f-57d42a327c17", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--e4a533dd-1afc-5923-833c-33d5ce20439a", "toId": "13dd9fbe-1cc0-4e6d-9c56-f54499d8e7e1", "to_id": "13dd9fbe-1cc0-4e6d-9c56-f54499d8e7e1", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.927Z", "created_at": "2026-09-26T17:50:03.953Z", "modified": "2026-09-26T17:50:04.109Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:50:04.109Z" }, "description_available": false, "entity_type": "indicates", "fromId": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_id": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_name": null, "from_type": "Indicator", "id": "3980ef20-2b98-48d6-9030-26b7da583783", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--c2c0a1db-e838-500b-b181-9bbad2208187", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.706Z", "created_at": "2026-09-26T17:47:19.081Z", "modified": "2026-09-26T17:47:24.499Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:24.499Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_id": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_name": null, "from_type": "Indicator", "id": "3aae23af-0099-4f55-bb0c-3816085f7ba4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--4cc3a120-a487-51e5-9836-04f17d709d44", "toId": "cb8b4429-67a0-4d4c-b027-6ef05f967f92", "to_id": "cb8b4429-67a0-4d4c-b027-6ef05f967f92", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.786Z", "created_at": "2026-09-26T17:49:06.353Z", "modified": "2026-09-26T17:49:06.581Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:06.581Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_id": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_name": null, "from_type": "Indicator", "id": "42b02308-7967-4b22-8314-8d936749f0e1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--1eb62204-8e5e-579d-8fb5-5324beb432a1", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.722Z", "created_at": "2026-09-26T17:47:41.296Z", "modified": "2026-09-26T17:47:54.902Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:54.902Z" }, "description_available": false, "entity_type": "based-on", "fromId": "552c49f8-0225-4395-a191-478a27c246c0", "from_id": "552c49f8-0225-4395-a191-478a27c246c0", "from_name": null, "from_type": "Indicator", "id": "43fea35f-94f4-45ac-9add-585f7cb148bd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--cb6eda03-fd53-5fc9-bd2e-cdc94e467a34", "toId": "4da99387-da33-493f-bd0a-e4c6ee64940a", "to_id": "4da99387-da33-493f-bd0a-e4c6ee64940a", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.929Z", "created_at": "2026-09-26T17:50:06.223Z", "modified": "2026-09-26T17:50:06.794Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:50:06.794Z" }, "description_available": false, "entity_type": "indicates", "fromId": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_id": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_name": null, "from_type": "Indicator", "id": "49edd742-5ed3-418e-832b-b78a2b55cc42", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--6d29e1d6-99f0-5ec5-89d2-905fa39f6610", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.632Z", "created_at": "2026-09-26T17:46:06.344Z", "modified": "2026-09-26T17:46:06.709Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:46:06.709Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "54774581-ae40-4f88-ba8d-29f412af0d91", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--0f8bdedb-18b6-5e8e-b4a0-7f0c7a92dcd4", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.730Z", "created_at": "2026-09-26T17:48:08.665Z", "modified": "2026-09-26T17:48:09.137Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:09.137Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_id": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_name": null, "from_type": "Indicator", "id": "5ae63b40-1f72-46a4-9c5e-bfeed86a0976", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--53ce4a02-7abd-528e-912d-dc37ef2bbbe9", "toId": "a6d4d915-70c8-481c-b91a-546b0fea1f0d", "to_id": "a6d4d915-70c8-481c-b91a-546b0fea1f0d", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.731Z", "created_at": "2026-09-26T17:48:12.876Z", "modified": "2026-09-26T17:48:13.052Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:13.052Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_id": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_name": null, "from_type": "Indicator", "id": "5af4cd1c-3ecb-48bf-8bda-f0215cf71094", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--1553c724-e614-5662-9627-9cd23ee63067", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.731Z", "created_at": "2026-09-26T17:48:08.656Z", "modified": "2026-09-26T17:48:09.138Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:09.138Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_id": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_name": null, "from_type": "Indicator", "id": "5ee05911-f4a8-4c53-a64d-1c34e23e81ab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--07a5fcb8-5f30-5aa9-b355-34f5b77f15ff", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.785Z", "created_at": "2026-09-26T17:49:05.692Z", "modified": "2026-09-26T17:49:05.960Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:05.960Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_id": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_name": null, "from_type": "Indicator", "id": "63928d15-11b0-471a-b8d8-7c2a8137905d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--adeaba9a-1cdf-58f5-a580-2df640981b5c", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.928Z", "created_at": "2026-09-26T17:50:04.380Z", "modified": "2026-09-26T17:50:05.193Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:50:05.193Z" }, "description_available": false, "entity_type": "indicates", "fromId": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_id": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_name": null, "from_type": "Indicator", "id": "688f2f47-8960-497d-acd8-a9e6938dbaaa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--80ac9a1f-24cf-5854-a4b4-54ff440e70b3", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.902Z", "created_at": "2026-09-26T17:49:34.050Z", "modified": "2026-09-26T17:49:35.783Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:35.783Z" }, "description_available": false, "entity_type": "indicates", "fromId": "552c49f8-0225-4395-a191-478a27c246c0", "from_id": "552c49f8-0225-4395-a191-478a27c246c0", "from_name": null, "from_type": "Indicator", "id": "6928c477-15e3-47d7-9686-7d972b175453", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--b2dce9c8-d4d3-55fa-a527-f9de62b37d2f", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.745Z", "created_at": "2026-09-26T17:48:27.159Z", "modified": "2026-09-26T17:48:27.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:27.375Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_id": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_name": null, "from_type": "Indicator", "id": "714f8fe7-4ee0-41ce-97e5-c3e429d28fbc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--f97e05ce-0cec-5f21-867f-3624955ace3f", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.732Z", "created_at": "2026-09-26T17:48:13.899Z", "modified": "2026-09-26T17:48:14.072Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:14.072Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_id": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_name": null, "from_type": "Indicator", "id": "79d6cf3a-cbc6-44dc-9571-d6556b8b1981", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--baa72fff-9a12-5b92-adef-880c31cdcb5d", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.903Z", "created_at": "2026-09-26T17:49:36.662Z", "modified": "2026-09-26T17:49:36.992Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:36.992Z" }, "description_available": false, "entity_type": "indicates", "fromId": "552c49f8-0225-4395-a191-478a27c246c0", "from_id": "552c49f8-0225-4395-a191-478a27c246c0", "from_name": null, "from_type": "Indicator", "id": "7ba14ad1-9b58-48d2-b597-5dbf41c6a178", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--f6b15ab3-e777-5b84-9190-3d3883215521", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.725Z", "created_at": "2026-09-26T17:47:41.698Z", "modified": "2026-09-26T17:47:54.673Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:54.673Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_id": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_name": null, "from_type": "Indicator", "id": "901e2cf4-8579-42ea-a2f5-2426d5125d77", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--92656f71-373f-5f85-9f6a-9dbc826a3a65", "toId": "35ff1ce1-13b8-4b71-a0c4-7a4d29f6ac93", "to_id": "35ff1ce1-13b8-4b71-a0c4-7a4d29f6ac93", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.787Z", "created_at": "2026-09-26T17:49:06.938Z", "modified": "2026-09-26T17:49:07.824Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:07.824Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_id": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_name": null, "from_type": "Indicator", "id": "91e15ffe-ec11-436d-ac48-ccabcb103a0e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--219fd087-fa12-504d-bc4a-21f9955b8b22", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.941Z", "created_at": "2026-09-26T17:50:21.862Z", "modified": "2026-09-26T17:50:22.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:50:22.375Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_id": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "from_name": null, "from_type": "Indicator", "id": "96e24d85-154d-49a0-b5d2-0ce4af506284", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--98f36436-e93e-51c9-9bd8-c2b68d778e2f", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.717Z", "created_at": "2026-09-26T17:47:29.049Z", "modified": "2026-09-26T17:47:33.006Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:33.006Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_id": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "from_name": null, "from_type": "Indicator", "id": "985001ac-4342-4d2d-8079-23217582b8e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--87436b8e-b53f-574b-90a9-67daefa5a99c", "toId": "90f2d6ed-545f-4e04-9b34-3727b27b02f8", "to_id": "90f2d6ed-545f-4e04-9b34-3727b27b02f8", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.758Z", "created_at": "2026-09-26T17:48:39.655Z", "modified": "2026-09-26T17:48:39.943Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:39.943Z" }, "description_available": false, "entity_type": "indicates", "fromId": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_id": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "from_name": null, "from_type": "Indicator", "id": "9ec6f9c2-009e-4c21-a994-a75092b64624", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--bc57b053-5a7d-56a7-9595-8314eb93232b", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.802Z", "created_at": "2026-09-26T17:49:20.759Z", "modified": "2026-09-26T17:49:21.000Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:21.000Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_id": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_name": null, "from_type": "Indicator", "id": "a7d639c1-b087-4631-a7a2-1b20e95973a5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--52e0aa54-7525-5009-baa1-6af5e75ecd7f", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.915Z", "created_at": "2026-09-26T17:49:46.704Z", "modified": "2026-09-26T17:49:46.941Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:46.941Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_id": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_name": null, "from_type": "Indicator", "id": "a9dc4129-dd8c-410a-8954-3f8cb3aa32a1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--6f9a67b6-f177-556c-b444-95ee1b400424", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.772Z", "created_at": "2026-09-26T17:48:54.150Z", "modified": "2026-09-26T17:48:54.350Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:54.350Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5125945d-5533-463f-a048-0146aba1ab01", "from_id": "5125945d-5533-463f-a048-0146aba1ab01", "from_name": null, "from_type": "Indicator", "id": "ad00656a-19e9-4559-898e-a90159caa5f2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--fc42aec4-4acc-5808-afd5-0253affd7ef2", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.771Z", "created_at": "2026-09-26T17:48:53.591Z", "modified": "2026-09-26T17:48:53.771Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:53.771Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5125945d-5533-463f-a048-0146aba1ab01", "from_id": "5125945d-5533-463f-a048-0146aba1ab01", "from_name": null, "from_type": "Indicator", "id": "af0e9154-2273-4f21-a1fb-5716ecab0d1e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--7ca14fc6-1b83-5b3c-adc8-be7c797b7577", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:48:49.793Z", "created_at": "2026-09-25T11:53:08.170Z", "modified": "2026-09-25T11:53:11.185Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:53:11.185Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "cad7a501-80f1-4440-87fa-bb5993338bb7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--3943645c-6cc3-5a05-ac13-8706f92a278b", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.744Z", "created_at": "2026-09-26T17:48:30.114Z", "modified": "2026-09-26T17:48:30.308Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:30.308Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_id": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_name": null, "from_type": "Indicator", "id": "d6f90718-69f8-4a51-88f5-bc9ca2704aa0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--c7d1a6d4-1ee5-5e35-854e-f68aa78f66a7", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.804Z", "created_at": "2026-09-26T17:49:25.539Z", "modified": "2026-09-26T17:49:25.701Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:25.701Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_id": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_name": null, "from_type": "Indicator", "id": "db91d59d-c942-4cf0-ab28-f287fa1726f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--57ae0562-5fb6-5135-ab8e-a02bee39477c", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.744Z", "created_at": "2026-09-26T17:48:25.808Z", "modified": "2026-09-26T17:48:26.209Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:48:26.209Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_id": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "from_name": null, "from_type": "Indicator", "id": "e0a67839-e93b-4e36-9c8d-cc8fe0d99c59", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--e69ccaeb-3c91-5178-8c16-d3591ca0843d", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.714Z", "created_at": "2026-09-26T17:47:28.443Z", "modified": "2026-09-26T17:47:30.863Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:30.863Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5125945d-5533-463f-a048-0146aba1ab01", "from_id": "5125945d-5533-463f-a048-0146aba1ab01", "from_name": null, "from_type": "Indicator", "id": "e1dfc935-6525-47df-a88e-87039a175824", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--895ff017-67c9-5d7f-8a17-2f0230766448", "toId": "ea818d91-785f-437a-927a-d58b6414d8ee", "to_id": "ea818d91-785f-437a-927a-d58b6414d8ee", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.727Z", "created_at": "2026-09-26T17:47:47.271Z", "modified": "2026-09-26T17:47:54.904Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:54.904Z" }, "description_available": false, "entity_type": "based-on", "fromId": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_id": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "from_name": null, "from_type": "Indicator", "id": "e3e4c420-3586-4aa1-bd7f-a885fe2728ae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--ccb3feab-1b65-58c2-b30f-95c5613ebcf0", "toId": "d3384abc-8c66-4c5f-9787-6f140a6b08f2", "to_id": "d3384abc-8c66-4c5f-9787-6f140a6b08f2", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.801Z", "created_at": "2026-09-26T17:49:20.195Z", "modified": "2026-09-26T17:49:20.452Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:20.452Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_id": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "from_name": null, "from_type": "Indicator", "id": "e587ea3a-7cc4-498d-a310-fc11b66199c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--d176b952-57ce-5a48-b15d-1a3652711f61", "toId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "to_name": "DPRK", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.703Z", "created_at": "2026-09-26T17:47:18.985Z", "modified": "2026-09-26T17:47:22.963Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:47:22.963Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_id": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "from_name": null, "from_type": "Indicator", "id": "edae6fd0-bcf2-4694-9ec5-4e2b33318200", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--ef5730fe-93cb-570b-b6f4-347767a26fa9", "toId": "3abc185d-a177-4dfa-b79d-303328225d66", "to_id": "3abc185d-a177-4dfa-b79d-303328225d66", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.916Z", "created_at": "2026-09-26T17:49:50.964Z", "modified": "2026-09-26T17:49:52.132Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:52.132Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_id": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_name": null, "from_type": "Indicator", "id": "f6786ab7-b2ce-449f-8782-a3f19ff716cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--d99c9206-2531-5582-8aa7-69cf9bb30ea5", "toId": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "to_name": "OtterCookie", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:05.915Z", "created_at": "2026-09-26T17:49:47.412Z", "modified": "2026-09-26T17:49:47.611Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:49:47.611Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_id": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "from_name": null, "from_type": "Indicator", "id": "fff69ef0-d632-4de2-9efb-a8f89392338f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--e015cb4a-71f8-5cd3-bfc9-5d6f125d9374", "toId": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "to_name": "WeaselBiscuit", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]170[.]217[.]184", "description_available": true, "object_id": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "object_ids": [ "cb8b4429-67a0-4d4c-b027-6ef05f967f92", "d5c96fc2-a622-4888-a9dc-bc7b903a6206" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d5c96fc2-a622-4888-a9dc-bc7b903a6206", "valid_from": "2026-09-18T14:24:35.000Z", "valid_until": "2026-10-08T19:59:14.434Z", "validity_status": "revoked", "value": "103.170.217.184" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "cb8b4429-67a0-4d4c-b027-6ef05f967f92", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.170.217.184" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "ipv4", "valid_from": "2026-09-18T14:24:35.000Z", "valid_until": "2026-10-08T19:59:14.434Z", "validity_status": "revoked", "value": "103.170.217.184" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159", "description_available": false, "object_id": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "object_ids": [ "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "5e8c4e4c-ca30-4b92-b5bf-e62ac80ab832" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "368eb49d-e5a6-4188-848e-7c0bb7cc1d77", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2027-07-06T00:46:48.557Z", "validity_status": "active", "value": "7b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5e8c4e4c-ca30-4b92-b5bf-e62ac80ab832", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "sha256", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2027-07-06T00:46:48.557Z", "validity_status": "active", "value": "7b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//103[.]170[.]217[.]184[:]8787", "description_available": false, "object_id": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "object_ids": [ "3abc185d-a177-4dfa-b79d-303328225d66", "d213a356-023d-41bd-b5cb-64bd91d1d36e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d213a356-023d-41bd-b5cb-64bd91d1d36e", "valid_from": "2026-09-18T14:24:35.000Z", "valid_until": "2026-10-08T19:59:14.434Z", "validity_status": "revoked", "value": "http://103.170.217.184:8787" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "3abc185d-a177-4dfa-b79d-303328225d66", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://103.170.217.184:8787" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T14:24:35.000Z", "valid_until": "2026-10-08T19:59:14.434Z", "validity_status": "revoked", "value": "http://103.170.217.184:8787" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]npoint[.]io/24c12c4b66a29747764f", "description_available": false, "object_id": "5125945d-5533-463f-a048-0146aba1ab01", "object_ids": [ "5125945d-5533-463f-a048-0146aba1ab01", "ea818d91-785f-437a-927a-d58b6414d8ee" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5125945d-5533-463f-a048-0146aba1ab01", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/24c12c4b66a29747764f" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "ea818d91-785f-437a-927a-d58b6414d8ee", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.npoint.io/24c12c4b66a29747764f" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/24c12c4b66a29747764f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]npoint[.]io/24c25d5f5fcbb0992a4f", "description_available": false, "object_id": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "object_ids": [ "0dad3fe5-f810-4df1-a9c4-b949b970347e", "90f2d6ed-545f-4e04-9b34-3727b27b02f8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0dad3fe5-f810-4df1-a9c4-b949b970347e", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/24c25d5f5fcbb0992a4f" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "90f2d6ed-545f-4e04-9b34-3727b27b02f8", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.npoint.io/24c25d5f5fcbb0992a4f" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/24c25d5f5fcbb0992a4f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]npoint[.]io/33e8d008c334b060adad", "description_available": false, "object_id": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "object_ids": [ "13dd9fbe-1cc0-4e6d-9c56-f54499d8e7e1", "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b6b8d0cc-7471-42c3-85b7-2ecce2cd533a", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/33e8d008c334b060adad" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "13dd9fbe-1cc0-4e6d-9c56-f54499d8e7e1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.npoint.io/33e8d008c334b060adad" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/33e8d008c334b060adad" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]npoint[.]io/37c0a0c68bf7a94ed731", "description_available": false, "object_id": "552c49f8-0225-4395-a191-478a27c246c0", "object_ids": [ "4da99387-da33-493f-bd0a-e4c6ee64940a", "552c49f8-0225-4395-a191-478a27c246c0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "552c49f8-0225-4395-a191-478a27c246c0", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/37c0a0c68bf7a94ed731" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "4da99387-da33-493f-bd0a-e4c6ee64940a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.npoint.io/37c0a0c68bf7a94ed731" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/37c0a0c68bf7a94ed731" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]npoint[.]io/641d37178a880b1e8b8f", "description_available": false, "object_id": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "object_ids": [ "35ff1ce1-13b8-4b71-a0c4-7a4d29f6ac93", "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5168f7e6-1b8c-4d1c-9d7b-53c9d43f94be", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/641d37178a880b1e8b8f" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "35ff1ce1-13b8-4b71-a0c4-7a4d29f6ac93", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.npoint.io/641d37178a880b1e8b8f" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/641d37178a880b1e8b8f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]npoint[.]io/933a731a5e97f4b45249", "description_available": false, "object_id": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "object_ids": [ "91efe388-a1fe-46ee-83c2-7c5447a196f4", "d3384abc-8c66-4c5f-9787-6f140a6b08f2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "91efe388-a1fe-46ee-83c2-7c5447a196f4", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/933a731a5e97f4b45249" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "d3384abc-8c66-4c5f-9787-6f140a6b08f2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.npoint.io/933a731a5e97f4b45249" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/933a731a5e97f4b45249" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxps[:]//api[.]npoint[.]io/ddae72efbb6714fae922", "description_available": false, "object_id": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "object_ids": [ "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "a6d4d915-70c8-481c-b91a-546b0fea1f0d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2a6f00a5-784c-42d5-81ce-73b9b3a4503a", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/ddae72efbb6714fae922" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "a6d4d915-70c8-481c-b91a-546b0fea1f0d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "https://api.npoint.io/ddae72efbb6714fae922" } ], "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "type": "url", "valid_from": "2026-09-18T13:37:04.000Z", "valid_until": "2026-10-08T19:11:43.434Z", "validity_status": "revoked", "value": "https://api.npoint.io/ddae72efbb6714fae922" } ], "mentioned": [ { "confidence": 50, "evidence_id": "1c0e67a9-8a70-4fb1-9440-96d8c2326c77", "name": "OtterCookie", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "7f5deef1-05e1-4204-8f0c-b68157057bb7", "name": "WeaselBiscuit", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.959Z", "created_at": "2026-02-26T09:45:20.459Z", "modified": "2026-02-26T09:45:20.639Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:20.639Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "441825f5-5c17-4a30-89e9-11a1ec420c2c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--cd0105c2-8b5f-5dd5-bd6a-41e97218e2a1", "toId": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_name": "TA0008", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.960Z", "created_at": "2026-02-26T09:45:20.913Z", "modified": "2026-02-26T09:45:21.128Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:21.128Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "a30af46a-d0b5-4708-b5a1-3dc9d0e0623a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--1b8cc33f-04e1-5b96-8c29-90d9df5b5235", "toId": "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc", "to_id": "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc", "to_name": "TA0040", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.957Z", "created_at": "2026-02-26T09:45:19.402Z", "modified": "2026-02-26T09:45:19.641Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:19.641Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "bd9ae72a-7e07-4487-848f-b7e35a7fba57", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--bb8ee6a4-cf36-567e-b830-2656babc9c0a", "toId": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_name": "TA0001", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:16:18.959Z", "created_at": "2026-02-26T09:45:22.841Z", "modified": "2026-02-26T09:45:23.203Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T09:45:23.203Z" }, "description_available": false, "entity_type": "uses", "fromId": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "from_name": "DPRK", "from_type": "IntrusionSet", "id": "d0efb2b2-196a-42f3-8496-31d5cae2bb18", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "standard_id": "relationship--0353cab3-7307-5c6f-ae6b-96ddb09ace9d", "toId": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_name": "TA0007", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "TA0008" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.150Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.150Z", "created_at": "2026-01-21T11:31:19.514Z", "modified": "2026-01-21T11:31:20.180Z", "updated_at": "2026-01-21T11:31:20.180Z" }, "description_available": false, "evidence_ids": [ "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "441825f5-5c17-4a30-89e9-11a1ec420c2c" ], "external_id": null, "id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-01-21T11:31:20.180Z", "name": "TA0008", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0008", "id": "ad7866d4-e709-45c7-a0b3-721cd0ac76a9", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0008" } ], "relationship_ids": [ "441825f5-5c17-4a30-89e9-11a1ec420c2c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0001" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:16:18.950Z", "created_by": null, "dates": { "created": "2026-01-19T18:16:18.950Z", "created_at": "2026-02-26T09:42:18.208Z", "modified": "2026-02-26T09:42:18.968Z", "updated_at": "2026-02-26T09:42:18.968Z" }, "description_available": false, "evidence_ids": [ "008dd51f-8f8d-4be2-a41b-6191033560d2", "bd9ae72a-7e07-4487-848f-b7e35a7fba57" ], "external_id": null, "id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-26T09:42:18.968Z", "name": "TA0001", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0001", "id": "b9b34b9a-84bd-442c-a126-8dd241c3fecc", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0001" } ], "relationship_ids": [ "bd9ae72a-7e07-4487-848f-b7e35a7fba57" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0040" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:16:18.954Z", "created_by": null, "dates": { "created": "2026-01-19T18:16:18.954Z", "created_at": "2026-02-26T09:42:19.216Z", "modified": "2026-02-26T09:42:20.265Z", "updated_at": "2026-02-26T09:42:20.265Z" }, "description_available": false, "evidence_ids": [ "a30af46a-d0b5-4708-b5a1-3dc9d0e0623a", "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc" ], "external_id": null, "id": "a677bfc0-d7d0-4c43-a6c7-63dd332b0edc", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-26T09:42:20.265Z", "name": "TA0040", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0040", "id": "431fc300-4868-4d6d-942b-0997dacf8890", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0040" } ], "relationship_ids": [ "a30af46a-d0b5-4708-b5a1-3dc9d0e0623a" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0007" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:04:26.693Z", "created_by": null, "dates": { "created": "2026-01-19T18:04:26.693Z", "created_at": "2026-02-24T10:59:25.122Z", "modified": "2026-02-24T10:59:25.604Z", "updated_at": "2026-02-24T10:59:25.604Z" }, "description_available": false, "evidence_ids": [ "b567183b-d314-4266-96a5-7c9ed53ab2b0", "d0efb2b2-196a-42f3-8496-31d5cae2bb18" ], "external_id": null, "id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-24T10:59:25.604Z", "name": "TA0007", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0007", "id": "9e1f03d3-a465-4763-b502-2eb00bbd87eb", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0007" } ], "relationship_ids": [ "d0efb2b2-196a-42f3-8496-31d5cae2bb18" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit", "tactics": [], "url": null, "via_entities": [ { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } ] } ], "via_entity": { "id": "331cfc07-a2a5-4c42-8baa-6590a491bb38", "name": "DPRK", "type": "IntrusionSet" } } ], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-18T13:37:03.804Z", "created_at": "2026-09-26T17:50:40.415Z", "modified": "2026-09-26T17:50:44.444Z", "published": "2026-09-18T13:37:03.804Z", "updated_at": "2026-09-26T17:50:44.444Z" }, "description_available": true, "id": "39674078-e211-43d6-933a-93d7d6936d49", "is_inferred": false, "labels": [ "beavertail", "chrome extension theft", "invisibleferret", "npm supply chain", "ottercookie", "weaselbiscuit" ], "lang": "en", "name": "WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-18T13:37:03.804Z", "references": [ { "external_id": "6aad3e7f8cc155ff864b444b", "id": "8838550e-4c12-4b7e-8270-632f4b47c323", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aad3e7f8cc155ff864b444b" }, { "external_id": null, "id": "d51a1b37-04e0-4340-91b7-b100546114c4", "source_name": "malpedia", "url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "39674078-e211-43d6-933a-93d7d6936d49", "schema_version": 1, "selected_date": "2026-09-18", "source_url": "https://opensourcemalware.com/blog/introducing-weaselbiscuit" }