{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 33, "direct_entities": 77, "direct_relationships": 36, "invalid_iocs": 0, "iocs": 33, "mentioned": 5, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 6, "vulnerabilities": 4 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 0, "excluded_graph_objects": 1148, "graph_complete": true, "graph_objects": 77, "graph_relationships": 36, "mitre_context_complete": true, "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "status_as_of": "2026-10-10T12:59:34+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:17.875Z", "updated_at": "2026-09-26T17:24:20.215Z" }, "description_available": false, "entity_type": "Url", "id": "03d461d5-9e1e-49c7-93ff-1791e4beb133", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--81c990cc-fe66-5efd-b080-e75ba1b31c2e", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.185Z", "created_at": "2026-09-26T17:24:50.100Z", "modified": "2026-09-26T17:25:04.607Z", "updated_at": "2026-09-26T17:25:04.607Z" }, "description_available": false, "entity_type": "Indicator", "id": "05a76cad-5895-4fa8-8706-04e1ef78e939", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--cc1689da-e2e4-5781-a38f-ce7f67407f2a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.265Z", "created_at": "2026-09-26T17:25:19.708Z", "modified": "2026-09-26T17:29:43.660Z", "updated_at": "2026-09-26T17:29:43.660Z" }, "description_available": false, "entity_type": "Indicator", "id": "05e341df-1d25-4972-abf7-bfb0ab1aee69", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--e3b79f00-041d-5208-b44a-a62098ad2288", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.220Z", "created_at": "2026-09-26T17:25:03.811Z", "modified": "2026-09-26T17:26:06.185Z", "updated_at": "2026-09-26T17:26:06.185Z" }, "description_available": false, "entity_type": "Indicator", "id": "06f0cfcf-3486-4827-a115-535d99c7f269", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--305c6b06-6680-5100-a737-e77554db438f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.235Z", "created_at": "2026-09-26T17:25:08.958Z", "modified": "2026-09-26T17:28:19.507Z", "updated_at": "2026-09-26T17:28:19.507Z" }, "description_available": false, "entity_type": "Indicator", "id": "0a2bcf3c-c80b-4abb-a175-4195f2754771", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--e9f50fd6-ed1f-5328-80c6-237ad986b346", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:20.930Z", "updated_at": "2026-09-26T17:24:21.449Z" }, "description_available": false, "entity_type": "Url", "id": "0c306412-8fca-45c6-946f-89641c8c018b", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--d779cbda-5eb3-57ac-9b39-5c45302f3bdb", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.262Z", "created_at": "2026-09-26T17:25:19.695Z", "modified": "2026-09-26T17:29:39.874Z", "updated_at": "2026-09-26T17:29:39.874Z" }, "description_available": false, "entity_type": "Indicator", "id": "0d582fc1-ad74-4fbd-bff4-6f2c806a5efd", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--33bbe41a-1813-5163-8a49-a91fb66f2ad4", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:15.462Z", "updated_at": "2026-09-26T17:24:15.770Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "0dd6180e-89c5-4840-88a7-6784aa9ebef6", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--77b7834e-103e-5b3e-aa87-976cb7058ea8", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:38.125Z", "updated_at": "2026-09-26T17:24:38.515Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "0e467fc4-3fdf-4a84-bde8-4d4652a4df86", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--2977334c-d29f-51ee-93b8-40de32974183", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:21.167Z", "updated_at": "2026-09-26T17:24:21.768Z" }, "description_available": false, "entity_type": "StixFile", "id": "14026a51-1b25-4f88-8542-ccbe12805cde", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "file--4fc6202a-a343-5437-a406-8ffb46169989", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.255Z", "created_at": "2026-09-26T17:25:17.248Z", "modified": "2026-09-26T17:29:35.047Z", "updated_at": "2026-09-26T17:29:35.047Z" }, "description_available": false, "entity_type": "Indicator", "id": "159ee0cd-fcbf-4273-b060-252131ef1eae", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--8cfb844e-8e8a-5449-a513-4a77ba86ef17", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2024-07-01T13:15:06.467Z", "created_at": "2026-01-18T19:39:45.571Z", "modified": "2026-09-01T13:25:25.061Z", "updated_at": "2026-09-01T13:25:25.061Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "1827c478-b2de-413b-9779-4754d14ae900", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2024-6387", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "ff88fa99-ed65-4408-9eb5-dfce5e47971d", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "external_id": null, "id": "8c5e8bcb-d1a1-4301-bf1b-178a33b4912e", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-446545.html" }, { "external_id": "CVE-2024-6387", "id": "04607c6a-f0f8-4ccd-9c07-37a9b05a0fde", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6387" }, { "external_id": null, "id": "d15891dc-5109-4093-a384-54e2b0bbec3b", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/" }, { "external_id": null, "id": "2e74a189-9b9b-4b4f-957d-71955b44cf2d", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/" }, { "external_id": null, "id": "83613a0d-ddb2-46ff-82dd-2d00c4c1b880", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server" }, { "external_id": null, "id": "af941c35-a5e6-441d-8db9-e0df17ef711f", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://explore.alas.aws.amazon.com/CVE-2024-6387.html" }, { "external_id": null, "id": "f34f91cd-5b25-4ca0-8d78-10b3f2570c22", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc" }, { "external_id": null, "id": "9c7b1f02-8997-4a97-bdc0-eaef7d2468e0", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/AlmaLinux/updates/issues/629" }, { "external_id": null, "id": "22d090b1-8594-4141-a118-ad43e2c9ce21", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/Azure/AKS/issues/4379" }, { "external_id": null, "id": "6d4cb393-593c-4bf1-a0e8-a04e7508689c", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/PowerShell/Win32-OpenSSH/discussions/2248" }, { "external_id": null, "id": "a9fd9118-160c-458e-b420-6580f73c3eec", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/PowerShell/Win32-OpenSSH/issues/2249" }, { "external_id": null, "id": "95aec9e2-a389-4841-92d2-6f99c483b77e", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/microsoft/azurelinux/issues/9555" }, { "external_id": null, "id": "da1b2023-5363-4cf8-8c20-24127c8c21ce", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09" }, { "external_id": null, "id": "6c4b5a80-5de4-4fe0-97bf-c74a94c818f8", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/oracle/oracle-linux/issues/149" }, { "external_id": null, "id": "22e49253-2667-4e61-bacd-9a88cd40924b", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/rapier1/hpn-ssh/issues/87" }, { "external_id": null, "id": "8fd44c37-2620-417f-8dd3-721c9465cf0f", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/zgzhang/cve-2024-6387-poc" }, { "external_id": null, "id": "ed2311f1-9d3e-4a81-b803-952883942d20", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/" }, { "external_id": null, "id": "49771f44-2690-4d84-91b9-b915cbfb40bc", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html" }, { "external_id": null, "id": "696aad97-907f-4542-af52-3702544093fd", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://packetstorm.news/files/id/190587/" }, { "external_id": null, "id": "a95efc33-a456-4028-a07e-8ce9fdc4639d", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010" }, { "external_id": null, "id": "645afba2-fc7d-49a8-925f-54fb2c798487", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security-tracker.debian.org/tracker/CVE-2024-6387" }, { "external_id": null, "id": "94719c74-ab04-4e34-b8ea-3ba6e28ca8cf", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240701-0001/" }, { "external_id": null, "id": "42056ea8-0810-4a8f-b20b-8c22b1829239", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://sig-security.rocky.page/issues/CVE-2024-6387/" }, { "external_id": null, "id": "856dec5f-b61d-466e-b221-2fbd75913b95", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/" }, { "external_id": null, "id": "d0a4fb11-406d-4032-8842-53bcb7c0c62b", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.apple.com/kb/HT214118" }, { "external_id": null, "id": "a72a18ce-292a-418e-a324-0f8b9a231591", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.apple.com/kb/HT214119" }, { "external_id": null, "id": "3a3f1391-d5fe-46e5-b3d4-e4fa41e85a17", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.apple.com/kb/HT214120" }, { "external_id": null, "id": "21e89ac1-947d-446f-9a15-3376de357de3", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://ubuntu.com/security/CVE-2024-6387" }, { "external_id": null, "id": "1b23e268-a589-4a39-b928-9e606585a51a", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://ubuntu.com/security/notices/USN-6859-1" }, { "external_id": null, "id": "bf86d961-9dd0-4813-bd2f-cfda39404eb7", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do" }, { "external_id": null, "id": "0a3b3d28-4a92-4665-8565-2b89b648b912", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100" }, { "external_id": null, "id": "2c9567bd-4d69-4ce1-8d9d-fdb48a0c8664", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/52269" }, { "external_id": null, "id": "3dd53e93-4410-41a1-9815-98104258b33a", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc" }, { "external_id": null, "id": "d84b5099-1f91-477e-8c00-bc46c96577c7", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html" }, { "external_id": null, "id": "8a401b8d-0276-4dc2-9bbc-49f76d1a7585", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.suse.com/security/cve/CVE-2024-6387.html" }, { "external_id": null, "id": "8149771b-455c-463e-aaae-5226034129f8", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.theregister.com/2024/07/01/regresshion_openssh/" }, { "external_id": null, "id": "a03a0e70-0c9d-4956-8147-9a4878c8330f", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387" }, { "external_id": null, "id": "c37c2f5f-450f-4097-a143-ed592ac1bdb9", "source_name": "cve@mitre.org", "url": "https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html" }, { "external_id": null, "id": "9e0706bf-7f13-4c27-bb32-e28a5bcec1cc", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:4312" }, { "external_id": null, "id": "d63b712a-a296-467c-af3d-78166382d0cd", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:4340" }, { "external_id": null, "id": "f0035925-1624-4b00-b286-3bf24ff67cd0", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:4389" }, { "external_id": null, "id": "7749f1c6-de23-4758-a6f3-ec751cafd267", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:4469" }, { "external_id": null, "id": "731370a2-06f5-4fd6-85e3-b8cc59138e00", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:4474" }, { "external_id": null, "id": "c6876309-89d1-424b-930b-65cf6693cf27", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:4479" }, { "external_id": null, "id": "1e35c85d-d01b-4d62-95e8-a57a52c84d9a", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:4484" }, { "external_id": null, "id": "7221ed5c-fd4d-4e82-a11c-45c955312963", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2024-6387" }, { "external_id": null, "id": "fb1ca18f-1eda-4ad7-ab34-dfc4e1080fda", "source_name": "secalert@redhat.com", "url": "https://santandersecurityresearch.github.io/blog/sshing_the_masses.html" }, { "external_id": null, "id": "a7e18a9e-9e2a-449a-933c-ad8912ed88bc", "source_name": "secalert@redhat.com", "url": "https://www.openssh.com/txt/release-9.8" }, { "external_id": null, "id": "07399933-b1b0-4e0c-ae16-8ac1e010edb9", "source_name": "secalert@redhat.com", "url": "https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "vulnerability--5a3bace9-ba56-506d-a47e-dea589af7dbc", "type": "Vulnerability" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:40.786Z", "updated_at": "2026-09-26T17:24:41.369Z" }, "description_available": false, "entity_type": "Url", "id": "1b2f2c77-a170-48c8-ab41-a6389067ffb1", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--9f6b5d7d-c218-5929-8881-97d743b7c758", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.252Z", "created_at": "2026-09-26T17:25:15.795Z", "modified": "2026-10-08T18:51:04.573Z", "updated_at": "2026-10-08T18:51:04.573Z" }, "description_available": false, "entity_type": "Indicator", "id": "1b9a3463-e91e-45a1-ac69-581255fd585a", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--feb778b6-ea4e-50cc-8dec-cf7bb1a76f56", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:44.406Z", "updated_at": "2026-09-26T17:24:45.027Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "1dbfe028-2f60-48f0-b099-59f3ac18d7c0", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--19138d1e-1238-57a5-9b4c-0b7f4993f296", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.204Z", "created_at": "2026-09-26T17:24:58.255Z", "modified": "2026-09-26T17:25:41.991Z", "updated_at": "2026-09-26T17:25:41.991Z" }, "description_available": false, "entity_type": "Indicator", "id": "2035a3b1-a68b-4267-9b8c-bf86ae145b29", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--0cf9afda-8034-5c03-a72f-56ad6c62eea2", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:26.672Z", "updated_at": "2026-09-26T17:24:27.962Z" }, "description_available": false, "entity_type": "StixFile", "id": "2506ffd1-9604-4e55-b3c2-7ba2ef7f201d", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "file--4501c6ad-4363-5e83-bdd6-87cfefced3a4", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:15.508Z", "updated_at": "2026-09-26T17:24:15.860Z" }, "description_available": false, "entity_type": "Hostname", "id": "2f2f5c88-1cc8-4bc9-ab34-5020889c4800", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "hostname--0bc44d22-76ec-5bb3-80e3-5fc0c9db9d6c", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.192Z", "created_at": "2026-09-26T17:24:52.877Z", "modified": "2026-09-26T17:25:07.596Z", "updated_at": "2026-09-26T17:25:07.596Z" }, "description_available": false, "entity_type": "Indicator", "id": "2f6166eb-a601-4c17-a522-d2b0d620e41f", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--dd3a327e-08e2-50c6-8e6a-ea0d88c40b8d", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:31.302Z", "updated_at": "2026-09-26T17:24:32.372Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "3010da83-1ddb-473a-bb78-6257c5a76e96", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--de33cb83-64fe-5a53-8ab8-f5b53d00a78b", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:41.687Z", "updated_at": "2026-09-26T17:24:42.299Z" }, "description_available": false, "entity_type": "Url", "id": "32eba797-62ae-4775-8c5e-e11c53504ad6", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--d54bfa76-ded3-5d95-82d4-20ad0939a430", "type": "Url" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:17.620Z", "updated_at": "2026-09-26T17:24:20.214Z" }, "description_available": false, "entity_type": "Hostname", "id": "342b8519-5d30-4792-83a0-b80578b43743", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "hostname--f69bf4f4-8047-59eb-b0bf-62dc30b84c96", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.218Z", "created_at": "2026-09-26T17:25:02.263Z", "modified": "2026-09-26T17:25:58.074Z", "updated_at": "2026-09-26T17:25:58.074Z" }, "description_available": false, "entity_type": "Indicator", "id": "3885b33e-2b03-45f1-aefc-534783d39ec2", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--3c68156e-9564-5d32-9a93-d309b368234f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.174Z", "created_at": "2026-09-26T17:24:45.981Z", "modified": "2026-09-26T17:25:03.690Z", "updated_at": "2026-09-26T17:25:03.690Z" }, "description_available": false, "entity_type": "Indicator", "id": "3f398965-53b2-4e42-9582-64a3b36bf70b", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--6972e1cb-e24a-53b7-a417-8093fa832475", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.257Z", "created_at": "2026-09-26T17:25:17.369Z", "modified": "2026-09-26T17:29:36.769Z", "updated_at": "2026-09-26T17:29:36.769Z" }, "description_available": false, "entity_type": "Indicator", "id": "445fab51-9dd0-46b8-8b55-afe75cf2b237", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--5f9312a3-0646-5338-8e12-6b5ed9c2ac49", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2023-10-10T00:00:00.000Z", "created_at": "2026-01-18T18:17:11.433Z", "modified": "2026-08-12T22:24:17.414Z", "updated_at": "2026-08-12T22:24:17.414Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "45922536-c422-4dc8-bf93-37a124e40106", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2023-44487", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "ff88fa99-ed65-4408-9eb5-dfce5e47971d", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "external_id": null, "id": "2962861e-b9b6-4abb-9522-6fe8f4e90d58", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html" }, { "external_id": null, "id": "0f143766-2d10-42b0-af30-9395bf6e05ad", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784301.html" }, { "external_id": null, "id": "561a066c-6b48-43b4-9eac-8e8246dda742", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html" }, { "external_id": null, "id": "cd9f74e9-4f1f-4fbe-ab3c-ad0d848de7be", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html" }, { "external_id": "CVE-2023-44487", "id": "7340bef5-5540-4a2f-acc8-8e94ea1b9e84", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, { "external_id": null, "id": "136c4dcc-ccbb-4d5c-9347-63092840d73f", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/" }, { "external_id": null, "id": "94bed378-0311-480f-a9f0-e78b928d71d7", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/" }, { "external_id": null, "id": "b0f3d45b-8725-457e-a709-541a7d24ceed", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/" }, { "external_id": null, "id": "98dc4701-1362-4b15-9da4-3b29c34b28d5", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/" }, { "external_id": null, "id": "7a213d96-193f-4f69-8373-9cd1f6e06a0c", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/" }, { "external_id": null, "id": "8f1df655-9d49-470c-a7cc-9b031e2306f6", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/" }, { "external_id": null, "id": "3abfaf92-1e2a-4915-a7dd-00599ae08920", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/" }, { "external_id": null, "id": "47783459-4566-497a-81f6-7b5ca926ca37", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/" }, { "external_id": null, "id": "0d7d1f9e-f3c4-46ea-9e74-477c966de59e", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/" }, { "external_id": null, "id": "bab3a17f-b187-49c6-badb-bd6f02e9801a", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/" }, { "external_id": null, "id": "469ac4e6-5460-4b9b-be5f-07e62505e5fd", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/" }, { "external_id": null, "id": "1f36a115-2ea2-4e0e-807f-e721333f931a", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/" }, { "external_id": null, "id": "61b7f4bf-5b83-48b3-90a0-61aa4fdbc85b", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/" }, { "external_id": null, "id": "1e338492-de5d-401d-bf3f-670c7e95e558", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/" }, { "external_id": null, "id": "89223ef7-c497-48d8-82da-3edc9e5ccdfd", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/" }, { "external_id": null, "id": "2807d799-8296-41b9-9069-b49838f728c2", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/" }, { "external_id": null, "id": "ce443051-464c-463b-a48c-1069489d1340", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/" }, { "external_id": null, "id": "23f28e0b-250d-4941-99d0-7478abf6f4c0", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/" }, { "external_id": null, "id": "7ae47e1c-8ce4-457f-8ee0-3d1c4c91e55e", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/" }, { "external_id": null, "id": "6776c289-7c2f-4b98-89c2-980078a17ecd", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/" }, { "external_id": null, "id": "0a6f7e1a-7010-43b0-b623-b4673d286760", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/" }, { "external_id": null, "id": "4cb59a39-6cd0-4d3f-8303-6e02e450a139", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause" }, { "external_id": null, "id": "9736442c-04bd-4da5-9d9a-4dc7268cb061", "source_name": "cve@mitre.org", "url": "https://access.redhat.com/security/cve/cve-2023-44487" }, { "external_id": null, "id": "125b669f-ef13-4dc8-ab0c-f3f2f7013b34", "source_name": "cve@mitre.org", "url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/" }, { "external_id": null, "id": "d1359767-3074-49c7-9e0c-7e1b3828974d", "source_name": "cve@mitre.org", "url": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/" }, { "external_id": null, "id": "9cf3037b-f3fa-4d6f-891e-20633104ec5b", "source_name": "cve@mitre.org", "url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/" }, { "external_id": null, "id": "790c8122-825a-4230-8d7e-a51fcc5ee69d", "source_name": "cve@mitre.org", "url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/" }, { "external_id": null, "id": "12950375-ea32-424b-8c5e-d841a6d19962", "source_name": "cve@mitre.org", "url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/" }, { "external_id": null, "id": "03e602a3-8de5-4e44-a53e-6de3d6a887cc", "source_name": "cve@mitre.org", "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack" }, { "external_id": null, "id": "6154f2f3-edc4-41b1-83a3-6d5bfdbf00b1", "source_name": "cve@mitre.org", "url": "https://blog.vespa.ai/cve-2023-44487/" }, { "external_id": null, "id": "df37def0-b582-4eec-b562-cf85a65fa1c5", "source_name": "cve@mitre.org", "url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/" }, { "external_id": null, "id": "f8685150-23cd-4461-b938-8ea3d4667547", "source_name": "cve@mitre.org", "url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack" }, { "external_id": null, "id": "43bab32d-8c5e-433f-85f0-e7aa537c5bbd", "source_name": "cve@mitre.org", "url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125" }, { "external_id": null, "id": "6035a335-d32c-4dc3-a38f-bd4f0a1380a3", "source_name": "cve@mitre.org", "url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715" }, { "external_id": null, "id": "4bbfa85e-35f6-48e0-b8ff-4942f05578e0", "source_name": "cve@mitre.org", "url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve" }, { "external_id": null, "id": "232a3677-84d4-4705-914b-d5eb5f103465", "source_name": "cve@mitre.org", "url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764" }, { "external_id": null, "id": "9bbb3a41-fa4c-4101-8d96-6c7c6f0564ac", "source_name": "cve@mitre.org", "url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088" }, { "external_id": null, "id": "a3d243c5-a876-452c-b7cf-3e8c16b53638", "source_name": "cve@mitre.org", "url": "https://github.com/Azure/AKS/issues/3947" }, { "external_id": null, "id": "1a7abcef-eef1-4f06-9531-582f9211dd1e", "source_name": "cve@mitre.org", "url": "https://github.com/Kong/kong/discussions/11741" }, { "external_id": null, "id": "3c5cd911-38bb-4962-a351-9e5b3b7beda7", "source_name": "cve@mitre.org", "url": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3" }, { "external_id": null, "id": "1845458a-9933-44a1-82d7-6591c6de0d77", "source_name": "cve@mitre.org", "url": "https://github.com/advisories/GHSA-vx74-f528-fxqg" }, { "external_id": null, "id": "82155824-f64c-4b66-a6ef-d7c3590666e4", "source_name": "cve@mitre.org", "url": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p" }, { "external_id": null, "id": "dd96ac31-7e6c-472a-a2cb-e43cfa9c1cd3", "source_name": "cve@mitre.org", "url": "https://github.com/akka/akka-http/issues/4323" }, { "external_id": null, "id": "f52f327c-4650-48f2-b29c-68ad5ef77198", "source_name": "cve@mitre.org", "url": "https://github.com/alibaba/tengine/issues/1872" }, { "external_id": null, "id": "02fd6fec-6faa-46fd-9ef3-948323532fc1", "source_name": "cve@mitre.org", "url": "https://github.com/apache/apisix/issues/10320" }, { "external_id": null, "id": "5c1e54a0-002c-43cc-8e15-7c585d5a2194", "source_name": "cve@mitre.org", "url": "https://github.com/apache/httpd-site/pull/10" }, { "external_id": null, "id": "edceaf16-2084-48b0-8eb4-f147a7c2fab7", "source_name": "cve@mitre.org", "url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2" }, { "external_id": null, "id": "bc225f91-5467-4735-9de6-a30989df5643", "source_name": "cve@mitre.org", "url": "https://github.com/apache/trafficserver/pull/10564" }, { "external_id": null, "id": "e5953fc7-5678-4f1f-86d7-0e519975bbe9", "source_name": "cve@mitre.org", "url": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487" }, { "external_id": null, "id": "b8ddbd49-54dd-4625-8c70-030eaa4f0158", "source_name": "cve@mitre.org", "url": "https://github.com/bcdannyboy/CVE-2023-44487" }, { "external_id": null, "id": "eccd6fd7-d249-4808-b8cb-2f9755d4061a", "source_name": "cve@mitre.org", "url": "https://github.com/caddyserver/caddy/issues/5877" }, { "external_id": null, "id": "fb50c425-b339-43bd-99ca-3973dea4ef53", "source_name": "cve@mitre.org", "url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5" }, { "external_id": null, "id": "14dc1c53-f246-4c1c-9427-c4597a91b247", "source_name": "cve@mitre.org", "url": "https://github.com/dotnet/announcements/issues/277" }, { "external_id": null, "id": "6f8a2fb9-70d6-47fb-a28d-07580774767c", "source_name": "cve@mitre.org", "url": "https://github.com/eclipse/jetty.project/issues/10679" }, { "external_id": null, "id": "78ca65b3-8f52-424d-9d91-6881955039ff", "source_name": "cve@mitre.org", "url": "https://github.com/envoyproxy/envoy/pull/30055" }, { "external_id": null, "id": "469e9ed9-3766-49b1-9fbf-6150bce574c5", "source_name": "cve@mitre.org", "url": "https://github.com/etcd-io/etcd/issues/16740" }, { "external_id": null, "id": "bedfbeb1-2637-4b43-a319-074cc05b49ac", "source_name": "cve@mitre.org", "url": "https://github.com/facebook/proxygen/pull/466" }, { "external_id": null, "id": "567d4284-4a3d-42f5-a174-60a69dc0444c", "source_name": "cve@mitre.org", "url": "https://github.com/golang/go/issues/63417" }, { "external_id": null, "id": "31ae7ce3-04e8-49cf-a9a4-1c025f52acd4", "source_name": "cve@mitre.org", "url": "https://github.com/grpc/grpc-go/pull/6703" }, { "external_id": null, "id": "ca9caec4-2c50-478c-90a9-d043385b4602", "source_name": "cve@mitre.org", "url": "https://github.com/grpc/grpc/releases/tag/v1.59.2" }, { "external_id": null, "id": "18e0cdf7-4e22-48ec-b74f-c2f882076420", "source_name": "cve@mitre.org", "url": "https://github.com/h2o/h2o/pull/3291" }, { "external_id": null, "id": "6363e97b-9c49-46a7-b4bb-dd93babd2122", "source_name": "cve@mitre.org", "url": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf" }, { "external_id": null, "id": "7c7c27fd-d6d0-4de5-b8a9-96b85e8b2d19", "source_name": "cve@mitre.org", "url": "https://github.com/haproxy/haproxy/issues/2312" }, { "external_id": null, "id": "1faa3643-a907-4ecb-8e68-93014f47c420", "source_name": "cve@mitre.org", "url": "https://github.com/junkurihara/rust-rpxy/issues/97" }, { "external_id": null, "id": "cb540224-72b3-418a-80be-a7b2cddadefc", "source_name": "cve@mitre.org", "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1" }, { "external_id": null, "id": "acdb74b5-f9d3-42e5-b09c-ef644a56a2b5", "source_name": "cve@mitre.org", "url": "https://github.com/kazu-yamamoto/http2/issues/93" }, { "external_id": null, "id": "bd52ba62-5429-46ed-9dbe-3348c227764f", "source_name": "cve@mitre.org", "url": "https://github.com/kubernetes/kubernetes/pull/121120" }, { "external_id": null, "id": "c5883405-8cec-4506-8e17-3ef9c262b412", "source_name": "cve@mitre.org", "url": "https://github.com/line/armeria/pull/5232" }, { "external_id": null, "id": "2e646041-4a3b-4eee-8723-0b1ed09624e8", "source_name": "cve@mitre.org", "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632" }, { "external_id": null, "id": "4e0f6abf-22bc-4d01-a431-5359a47dcfb1", "source_name": "cve@mitre.org", "url": "https://github.com/micrictor/http2-rst-stream" }, { "external_id": null, "id": "58f9ba10-6ab1-46a0-8f82-c0290d59226b", "source_name": "cve@mitre.org", "url": "https://github.com/microsoft/CBL-Mariner/pull/6381" }, { "external_id": null, "id": "6f531322-ebbc-40d3-b24c-eb3b8fe2565a", "source_name": "cve@mitre.org", "url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61" }, { "external_id": null, "id": "4f971293-f4f0-451b-b4ea-63fe18ddbc06", "source_name": "cve@mitre.org", "url": "https://github.com/nghttp2/nghttp2/pull/1961" }, { "external_id": null, "id": "f3a3161a-67ff-4236-8873-6f61ae3a7ca7", "source_name": "cve@mitre.org", "url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0" }, { "external_id": null, "id": "50dea16a-aa64-4c49-9952-f265fd36fac5", "source_name": "cve@mitre.org", "url": "https://github.com/ninenines/cowboy/issues/1615" }, { "external_id": null, "id": "ea083323-a03d-46bc-a5fd-5b695b6126e3", "source_name": "cve@mitre.org", "url": "https://github.com/nodejs/node/pull/50121" }, { "external_id": null, "id": "7026acb8-f90b-43ba-b0e9-d2932e7e9744", "source_name": "cve@mitre.org", "url": "https://github.com/openresty/openresty/issues/930" }, { "external_id": null, "id": "a6e8b4eb-b13b-447d-9ea1-549b8b8d1299", "source_name": "cve@mitre.org", "url": "https://github.com/opensearch-project/data-prepper/issues/3474" }, { "external_id": null, "id": "8e8f9ed6-dd50-4285-b798-08fd4b1f254a", "source_name": "cve@mitre.org", "url": "https://github.com/oqtane/oqtane.framework/discussions/3367" }, { "external_id": null, "id": "556c8373-ee7b-4c94-9a55-6e416e62abf8", "source_name": "cve@mitre.org", "url": "https://github.com/projectcontour/contour/pull/5826" }, { "external_id": null, "id": "c4b7e943-22db-4485-9d86-dd4beeec2970", "source_name": "cve@mitre.org", "url": "https://github.com/tempesta-tech/tempesta/issues/1986" }, { "external_id": null, "id": "90fe06a9-fb14-46db-9245-b9f4b34bb541", "source_name": "cve@mitre.org", "url": "https://github.com/varnishcache/varnish-cache/issues/3996" }, { "external_id": null, "id": "a9bc0d7a-9b9e-482f-8d66-8bddcc41c32a", "source_name": "cve@mitre.org", "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo" }, { "external_id": null, "id": "7da95c0a-c3fa-4b0b-b6b4-35ae3b96ffb9", "source_name": "cve@mitre.org", "url": "https://istio.io/latest/news/security/istio-security-2023-004/" }, { "external_id": null, "id": "8aaa81af-4c73-42eb-ae4e-3b413b7f6408", "source_name": "cve@mitre.org", "url": "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/" }, { "external_id": null, "id": "f3de7128-b5a1-426e-bfb0-84ab7f4b8372", "source_name": "cve@mitre.org", "url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q" }, { "external_id": null, "id": "a196df5b-ad67-48b2-ae83-b00d0ecfc806", "source_name": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html" }, { "external_id": null, "id": "5c56f922-ec8d-4f17-b1dd-562305474ec9", "source_name": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html" }, { "external_id": null, "id": "b30c542b-12ea-48bc-b924-3c69d4eea0b5", "source_name": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html" }, { "external_id": null, "id": "24a44874-6958-4e0a-8526-90f47bce3451", "source_name": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html" }, { "external_id": null, "id": "645eb878-43a4-4f27-a757-4d7c4d8e3b3f", "source_name": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html" }, { "external_id": null, "id": "6c929d1c-f977-4fa9-9a5d-f68ceb945c98", "source_name": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html" }, { "external_id": null, "id": "68c0bb3d-d5b2-42ed-9afb-b5f6a9f69a45", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/" }, { "external_id": null, "id": "120e968e-dd01-4883-b95f-a111a7db32fb", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/" }, { "external_id": null, "id": "8229f1a3-27d4-4239-b77a-211381740bf8", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/" }, { "external_id": null, "id": "c510fa43-0f83-4089-86e6-46712ec10069", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/" }, { "external_id": null, "id": "34701aa6-4bcb-4b4f-ba94-dbe33dc9ca88", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/" }, { "external_id": null, "id": "e2bc611b-829f-42c7-bce6-9330aaa4e0b2", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/" }, { "external_id": null, "id": "9039e2dc-8a82-4c6c-9f3e-a238f9c1231a", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/" }, { "external_id": null, "id": "f09e73e0-03a3-42d9-b5ac-144bb368c111", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/" }, { "external_id": null, "id": "8a8b5f20-4611-4a4c-8282-70182f10cf87", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/" }, { "external_id": null, "id": "038ed12c-fcbc-4576-a5de-a01d3263d025", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/" }, { "external_id": null, "id": "f82f2ead-7900-4fc8-94ac-b1648378262c", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/" }, { "external_id": null, "id": "add75f0b-b1ff-4a38-bc1e-c81199ec6bf1", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/" }, { "external_id": null, "id": "6a98dbf9-12fc-4b76-b74a-6f820041adaf", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/" }, { "external_id": null, "id": "66aecc08-2358-4e4d-af44-7d647aab7135", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/" }, { "external_id": null, "id": "e4b701a3-36c2-4ccb-9a8d-50fb7da6d8a6", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/" }, { "external_id": null, "id": "72d510b2-296c-4d30-a539-735e70062364", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/" }, { "external_id": null, "id": "150e138c-b65f-4911-929f-4926c07a58b4", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/" }, { "external_id": null, "id": "853ae2b4-6b9d-407d-a6ca-ea93915f1069", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/" }, { "external_id": null, "id": "a91cb302-5291-4524-96e6-dc9af8e6c1d6", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/" }, { "external_id": null, "id": "71685dbb-c4a8-4e7c-9393-e2621f4911ae", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/" }, { "external_id": null, "id": "d2e896c5-4d36-44c8-93cc-0451afb8e799", "source_name": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/" }, { "external_id": null, "id": "be4e6f41-bde2-4395-a02d-1529b657a9bb", "source_name": "cve@mitre.org", "url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html" }, { "external_id": null, "id": "04aeb532-501d-416e-9e5e-6bebc539ff36", "source_name": "cve@mitre.org", "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html" }, { "external_id": null, "id": "571419b1-4f92-4469-9a4f-7e44d57468b4", "source_name": "cve@mitre.org", "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html" }, { "external_id": null, "id": "37a9fd03-0bf9-46be-a036-7f4e6d19d729", "source_name": "cve@mitre.org", "url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/" }, { "external_id": null, "id": "e2405356-7551-4ec1-8903-ab08756b80e9", "source_name": "cve@mitre.org", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487" }, { "external_id": null, "id": "56700910-aec2-4b63-b36d-06d9af2a53af", "source_name": "cve@mitre.org", "url": "https://my.f5.com/manage/s/article/K000137106" }, { "external_id": null, "id": "78835d6a-6f59-4c47-a024-53361deca2ba", "source_name": "cve@mitre.org", "url": "https://netty.io/news/2023/10/10/4-1-100-Final.html" }, { "external_id": null, "id": "9a75f45f-6444-44fa-a3e0-38c66935b2e1", "source_name": "cve@mitre.org", "url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/" }, { "external_id": null, "id": "4d202eac-adc4-4d4c-b9c2-236c73b2c120", "source_name": "cve@mitre.org", "url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected" }, { "external_id": null, "id": "79ed1d5b-d504-4b93-a11e-7cc666f6096c", "source_name": "cve@mitre.org", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ" }, { "external_id": null, "id": "a1865975-f903-4c6c-8a1a-997f4c6f832e", "source_name": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/202311-09" }, { "external_id": null, "id": "75610024-892c-4c2b-955b-99733cbd9541", "source_name": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20231016-0001/" }, { "external_id": null, "id": "d5052abc-8c59-4d57-ab4f-956d58d36d23", "source_name": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20240426-0007/" }, { "external_id": null, "id": "a7fff019-66aa-4c50-8430-3a07ee237361", "source_name": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" }, { "external_id": null, "id": "25591e22-394a-452f-9a7a-64652dd54ac9", "source_name": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20240621-0007/" }, { "external_id": null, "id": "ecfe4a42-e0fc-41f7-a5a2-67f4d6f0d5a6", "source_name": "cve@mitre.org", "url": "https://security.paloaltonetworks.com/CVE-2023-44487" }, { "external_id": null, "id": "97eb8236-b335-41a2-91f5-4b04e0b517b5", "source_name": "cve@mitre.org", "url": "https://ubuntu.com/security/CVE-2023-44487" }, { "external_id": null, "id": "754644e6-5a55-43ac-99d5-bd4581c12d19", "source_name": "cve@mitre.org", "url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/" }, { "external_id": null, "id": "7dc142f7-936f-4de0-acea-c7c2fb30aa34", "source_name": "cve@mitre.org", "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487" }, { "external_id": null, "id": "e9ce2e86-566d-47ff-acfa-e86aa5688c0f", "source_name": "cve@mitre.org", "url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event" }, { "external_id": null, "id": "2ac4089d-84b1-49b6-ab3b-89df33fdf282", "source_name": "cve@mitre.org", "url": "https://www.debian.org/security/2023/dsa-5521" }, { "external_id": null, "id": "3de28b66-16c2-476d-a251-e1a512457424", "source_name": "cve@mitre.org", "url": "https://www.debian.org/security/2023/dsa-5540" }, { "external_id": null, "id": "4dbcbfcd-989c-4f92-92f1-70a66fe2e0e8", "source_name": "cve@mitre.org", "url": "https://www.debian.org/security/2023/dsa-5549" }, { "external_id": null, "id": "4c9677c5-6c95-411f-ba29-5bb7c350ae11", "source_name": "cve@mitre.org", "url": "https://www.debian.org/security/2023/dsa-5558" }, { "external_id": null, "id": "c7982180-9e94-4f36-a214-c685cf5ff8d5", "source_name": "cve@mitre.org", "url": "https://www.debian.org/security/2023/dsa-5570" }, { "external_id": null, "id": "93b05a97-1e18-4f51-ab4b-f6a392bbc895", "source_name": "cve@mitre.org", "url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487" }, { "external_id": null, "id": "879b8964-3ea1-487d-bb8a-f1047875625a", "source_name": "cve@mitre.org", "url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/" }, { "external_id": null, "id": "2e1c7e8a-7939-41fa-bf7e-e71924e1fedf", "source_name": "cve@mitre.org", "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/" }, { "external_id": null, "id": "7d9341c0-07b6-49cd-8310-d18f294e8fae", "source_name": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2023/10/10/6" }, { "external_id": null, "id": "630723cc-e140-4da7-8323-863288e26b46", "source_name": "cve@mitre.org", "url": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack" }, { "external_id": null, "id": "1951bb33-918a-4b87-95f4-07e8f3a220c6", "source_name": "cve@mitre.org", "url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/" }, { "external_id": null, "id": "80ed2d0d-e19b-4c5b-951b-053a9f672a7f", "source_name": "security@apache.org", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html" }, { "external_id": null, "id": "5d5c0910-a18e-4ed0-969b-44492d1f07f8", "source_name": "security@apache.org", "url": "https://www.debian.org/security/2023/dsa-5522" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "vulnerability--4f9d8bd1-c1ac-55c4-b8eb-7de20ff7715e", "type": "Vulnerability" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:40.795Z", "updated_at": "2026-09-26T17:24:41.368Z" }, "description_available": false, "entity_type": "Url", "id": "49db1e41-fcc0-463c-ad4b-5d2cccbbd4c6", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--84a7f557-a0c0-5239-bd27-26fdeab0d7fc", "type": "Url" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T21:34:52.675Z", "updated_at": "2026-09-26T17:24:16.965Z" }, "description_available": false, "entity_type": "Url", "id": "5476f2a6-7def-474c-950d-7db651f042eb", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "blockchain infrastructure", "clickfix", "compromised websites", "deadlock", "decentralized communications", "etherhiding", "fakecaptcha", "lynx", "polygon", "polygon smart contracts", "ransomware" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--73e564ce-17c2-5834-9319-f3c537cc6656", "type": "Url" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2023-10-03T18:15:10.463Z", "created_at": "2026-01-18T18:14:57.775Z", "modified": "2026-05-15T00:43:41.780Z", "updated_at": "2026-05-15T00:43:41.780Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "55ef43e0-ab5e-4c07-99cf-8c9d0a608ab7", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2023-4911", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "ff88fa99-ed65-4408-9eb5-dfce5e47971d", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "external_id": null, "id": "9bbc55dd-d85d-4314-80e6-cf9bdebfe56f", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html" }, { "external_id": null, "id": "531ef4bb-1b58-4bf4-9b67-7dc0c5d11645", "source_name": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-831302.html" }, { "external_id": "CVE-2023-4911", "id": "1d5da626-0162-4f1a-acbd-4e34ae97031f", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4911" }, { "external_id": null, "id": "f2eec0de-b9a4-4915-a8ab-9c9b027967da", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/" }, { "external_id": null, "id": "e09303cf-ff6b-4794-868a-c51ca79e8afb", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/" }, { "external_id": null, "id": "eb78894d-5112-46a7-aa64-971a45bf2759", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/" }, { "external_id": null, "id": "be420871-d8f3-4f9c-a301-7252e3b9711e", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202310-03" }, { "external_id": null, "id": "dfce4605-97a3-47d3-a042-3c6f10a3d3aa", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20231013-0006/" }, { "external_id": null, "id": "e7074e20-239a-4462-a84a-07c7f576670f", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2023/dsa-5514" }, { "external_id": null, "id": "8c0438cf-7c03-461d-a25e-297b27314f6b", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/52479" }, { "external_id": null, "id": "e443435a-436f-44dc-85c2-a83dd7cd5a68", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2023:5453" }, { "external_id": null, "id": "91566b60-be68-4c96-81e0-75cefeabdc6e", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2023:5454" }, { "external_id": null, "id": "69a740be-6107-44ce-98e2-477738dbe7ff", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2023:5455" }, { "external_id": null, "id": "a6e99ecc-33a6-4164-853d-72015ae33714", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2023:5476" }, { "external_id": null, "id": "2d53c8ac-e969-464c-aaed-e580d5195176", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:0033" }, { "external_id": null, "id": "f0ecab5b-e1f5-475d-993a-23bd10cc94e7", "source_name": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2023-4911" }, { "external_id": null, "id": "c0bf8d28-5a5d-4857-a641-1a0e76e1a616", "source_name": "secalert@redhat.com", "url": "https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt" }, { "external_id": null, "id": "2cdfae47-d864-4646-a5a3-365e1e5839d0", "source_name": "secalert@redhat.com", "url": "https://www.qualys.com/cve-2023-4911/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "vulnerability--e3de7b33-75f7-5ffb-aebd-fda396e072c0", "type": "Vulnerability" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:23.235Z", "updated_at": "2026-09-26T17:24:26.529Z" }, "description_available": false, "entity_type": "StixFile", "id": "56dc31c3-3f81-4202-84f4-8b7c544df342", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "file--eb760409-d0e2-5657-9496-9a84190d8239", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:36.862Z", "updated_at": "2026-09-26T17:24:38.002Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "5cd9003e-ba80-46b2-b61f-11d516928388", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--ece89888-a1f0-5c61-b8be-49d5d464d299", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:27.231Z", "updated_at": "2026-09-26T17:24:28.947Z" }, "description_available": false, "entity_type": "StixFile", "id": "5e938570-e7ce-4a6c-b98f-4f1992d2c736", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "file--ca5239cf-49ae-52f8-8a2b-27b3a5050339", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.180Z", "created_at": "2026-09-26T17:24:48.177Z", "modified": "2026-09-26T17:25:06.724Z", "updated_at": "2026-09-26T17:25:06.724Z" }, "description_available": false, "entity_type": "Indicator", "id": "5f9be0ce-05c9-419f-978c-adae3d6304c6", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--77343970-42bb-50cb-9edc-b3f3a9f743a8", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:35.455Z", "updated_at": "2026-09-26T17:24:35.851Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "61ee1ee2-53e4-47cc-a6b1-9fbc28a95094", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--7af48643-41f9-50fe-9da8-fd2b03f0a169", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:41.680Z", "updated_at": "2026-09-26T17:24:41.912Z" }, "description_available": false, "entity_type": "Url", "id": "64812fa7-76b5-404b-8b08-c5d975e9167d", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--e68eba45-64f6-55b9-b7a7-9821912eb797", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.228Z", "created_at": "2026-09-26T17:25:07.051Z", "modified": "2026-09-26T17:27:23.046Z", "updated_at": "2026-09-26T17:27:23.046Z" }, "description_available": false, "entity_type": "Indicator", "id": "64bb9148-452c-4762-a4aa-0792658d7633", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--0489bfa5-b643-5446-a34a-3a0de461ebcc", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:21.973Z", "updated_at": "2026-09-26T17:24:22.636Z" }, "description_available": false, "entity_type": "StixFile", "id": "650f9078-5cdb-424e-811a-9b8f051fe5ab", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "file--5762d4f8-dc77-5884-8171-4999654d32e9", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.187Z", "created_at": "2026-09-26T17:24:52.872Z", "modified": "2026-10-08T18:51:02.844Z", "updated_at": "2026-10-08T18:51:02.844Z" }, "description_available": false, "entity_type": "Indicator", "id": "67adbfb3-4aac-427c-9a39-77715c32c2b3", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--9edc4e1f-c5aa-5553-9118-6dc35536ac09", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Financial", "Financial Industry (FI)", "Financial Services", "Financial-Services" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.391Z", "created_at": "2026-01-18T14:35:07.063Z", "modified": "2026-01-22T20:49:24.280Z", "updated_at": "2026-01-22T20:49:24.280Z" }, "description_available": true, "entity_type": "Sector", "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "is_inferred": false, "labels": [], "lang": "en", "name": "Finance", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7", "type": "Sector" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:30.156Z", "updated_at": "2026-09-26T17:24:30.505Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "729b8218-14a6-4aec-9fe9-a58c70187fd5", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--1ec87f43-0660-510e-9eef-864da637a6ae", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.201Z", "created_at": "2026-09-26T17:24:56.989Z", "modified": "2026-09-26T17:25:28.396Z", "updated_at": "2026-09-26T17:25:28.396Z" }, "description_available": false, "entity_type": "Indicator", "id": "73ab5033-2076-463d-95dd-25d00cb6b451", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--0f0378bd-7bd7-55ae-92ab-f8ba374d198f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.237Z", "created_at": "2026-09-26T17:25:09.173Z", "modified": "2026-09-26T17:28:36.084Z", "updated_at": "2026-09-26T17:28:36.084Z" }, "description_available": false, "entity_type": "Indicator", "id": "741815c0-caa8-4792-8149-5c45f3fa23b2", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--0899cb81-1e64-5ebc-92ec-3728b7292d56", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:45.709Z", "updated_at": "2026-09-26T17:24:46.592Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "7c6ba3a4-1ebe-4fd8-8c00-fb56908ca995", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--75c99b0a-09e0-5471-9842-c9d006346f1e", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.195Z", "created_at": "2026-09-26T17:24:56.729Z", "modified": "2026-09-26T17:25:19.367Z", "updated_at": "2026-09-26T17:25:19.367Z" }, "description_available": false, "entity_type": "Indicator", "id": "7c9f831c-696e-4aeb-ac88-bc5edbf5c5ba", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--bdc2617b-e08e-5383-bb02-7a9c70d6ad15", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.225Z", "created_at": "2026-09-26T17:25:04.015Z", "modified": "2026-09-26T17:26:42.914Z", "updated_at": "2026-09-26T17:26:42.914Z" }, "description_available": false, "entity_type": "Indicator", "id": "7ce786ac-b72a-4437-b72e-1d43d685e060", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--029d01fd-4e1e-56c9-a0df-eab881105143", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.207Z", "created_at": "2026-09-26T17:24:58.420Z", "modified": "2026-09-26T17:25:32.647Z", "updated_at": "2026-09-26T17:25:32.647Z" }, "description_available": false, "entity_type": "Indicator", "id": "846d37ab-6fab-426a-8262-8bafaf05d05a", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--a953710a-d96f-54cc-a422-25e8a6747819", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.213Z", "created_at": "2026-09-26T17:25:02.105Z", "modified": "2026-10-08T18:51:03.222Z", "updated_at": "2026-10-08T18:51:03.222Z" }, "description_available": false, "entity_type": "Indicator", "id": "84dd68ca-9bc9-439e-b47e-63cf1f3cfb98", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--a7781b92-5d84-58f9-a020-88938507d6a1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.182Z", "created_at": "2026-09-26T17:24:48.207Z", "modified": "2026-09-26T17:25:05.863Z", "updated_at": "2026-09-26T17:25:05.863Z" }, "description_available": false, "entity_type": "Indicator", "id": "8ed241be-5532-49d7-a61a-3bee8659aef4", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--256544a4-54e5-5516-8450-9a7ad469071e", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:32.727Z", "updated_at": "2026-09-26T17:24:34.253Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "8fa86049-1f66-4ee1-9c5b-f868279ac553", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--56fe1ca1-5c80-5528-9d71-e502e6acacf2", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-11T08:27:25.395Z", "created_at": "2026-08-11T21:35:02.757Z", "modified": "2026-09-26T17:24:47.805Z", "updated_at": "2026-09-26T17:24:47.805Z" }, "description_available": false, "entity_type": "Indicator", "id": "91dc4c20-28ea-429f-83de-e8d2fdcbdeed", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "blockchain infrastructure", "clickfix", "compromised websites", "deadlock", "decentralized communications", "etherhiding", "fakecaptcha", "lynx", "polygon", "polygon smart contracts", "ransomware" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--1ec570df-47b4-55e0-b108-d96adcb90c80", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.223Z", "created_at": "2026-09-26T17:25:04.005Z", "modified": "2026-09-26T17:27:05.334Z", "updated_at": "2026-09-26T17:27:05.334Z" }, "description_available": false, "entity_type": "Indicator", "id": "9247962b-e991-4b55-8ac3-413d503e4d45", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--c21fefbc-8e95-5d6e-92ec-ca4657c48aa3", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.216Z", "created_at": "2026-09-26T17:25:02.164Z", "modified": "2026-09-26T17:25:54.127Z", "updated_at": "2026-09-26T17:25:54.127Z" }, "description_available": false, "entity_type": "Indicator", "id": "93cdcbe7-f284-4139-b3f3-0d3d97902aff", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--7a2c553a-c9b3-59c6-97cc-02dd9cc44ea5", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:36.767Z", "updated_at": "2026-09-26T17:24:38.001Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "942951ea-3ad0-489b-86eb-7601012f54a4", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--959cfe14-fb65-5593-9f4f-43edd53b27d4", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:34.388Z", "updated_at": "2026-09-26T17:24:35.628Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "9743371a-7a52-4800-a69d-71fa61e19441", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--ba44f616-71e3-5a0d-8f16-3d496f1d52d3", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.230Z", "created_at": "2026-09-26T17:25:07.330Z", "modified": "2026-09-26T17:28:02.558Z", "updated_at": "2026-09-26T17:28:02.558Z" }, "description_available": false, "entity_type": "Indicator", "id": "9ec9ff98-41a8-4a9f-a28e-c37670ffbc0e", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--760839fb-8399-5b91-81c3-b7a4f9fb6ce8", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:17.698Z", "updated_at": "2026-09-26T17:24:19.932Z" }, "description_available": false, "entity_type": "Hostname", "id": "a02693d1-985b-4dbd-b7c7-1474c25f88f6", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "hostname--ce62fc00-3ef5-54b0-8cfd-13eb3ce39f22", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.210Z", "created_at": "2026-09-26T17:24:58.460Z", "modified": "2026-09-26T17:25:39.010Z", "updated_at": "2026-09-26T17:25:39.010Z" }, "description_available": false, "entity_type": "Indicator", "id": "a09dde4c-bf08-427b-97ad-62eb0f2fcd3c", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--39aff3f8-75fc-58b8-b8bc-fdabcfdd6597", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:22.907Z", "updated_at": "2026-09-26T17:24:24.126Z" }, "description_available": false, "entity_type": "StixFile", "id": "aafc163d-9691-4c53-8426-49c333e34704", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "file--2964f30a-04a5-5ccf-bfbd-1cb79c77cedc", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.244Z", "created_at": "2026-09-26T17:25:12.557Z", "modified": "2026-10-08T18:51:02.568Z", "updated_at": "2026-10-08T18:51:02.568Z" }, "description_available": false, "entity_type": "Indicator", "id": "accbb3ce-9b72-4ef5-8419-14894011e8db", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--224c3ba9-e66e-5726-acc7-b72f9448c46a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.247Z", "created_at": "2026-09-26T17:25:12.603Z", "modified": "2026-10-08T18:51:04.138Z", "updated_at": "2026-10-08T18:51:04.138Z" }, "description_available": false, "entity_type": "Indicator", "id": "b319be11-2488-4a56-8e9b-95fb769b16e0", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--da0a7aa5-dde4-5e29-8316-9c6443f201ac", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.260Z", "created_at": "2026-09-26T17:25:17.695Z", "modified": "2026-09-26T17:29:38.879Z", "updated_at": "2026-09-26T17:29:38.879Z" }, "description_available": false, "entity_type": "Indicator", "id": "b4e4f97b-9d17-4008-a862-26ba24205410", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--e30b2ba0-ec29-5bd3-abae-00bb04693d45", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.242Z", "created_at": "2026-09-26T17:25:10.522Z", "modified": "2026-10-08T18:51:03.476Z", "updated_at": "2026-10-08T18:51:03.476Z" }, "description_available": false, "entity_type": "Indicator", "id": "b54a2e46-e706-45d7-ae69-30810a70e29c", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--c2b73cc0-8c91-589c-b9ca-7f4d07a27b25", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2023-03-22T21:15:18.090Z", "created_at": "2026-01-18T17:45:28.885Z", "modified": "2026-09-26T17:24:15.085Z", "updated_at": "2026-09-26T17:24:15.085Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "b6f12009-6799-4f3c-b9d6-98717dbe7ec7", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2023-0386", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2023-0386", "id": "d19ed0f2-d9b8-4cf9-830e-3a897b5a4562", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0386" }, { "external_id": null, "id": "4d1143b5-d81e-4c08-b566-b0adea1b1f86", "source_name": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html" }, { "external_id": null, "id": "65a7ad7f-0c61-4295-af7f-0e61eaf13414", "source_name": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html" }, { "external_id": null, "id": "19ac1428-e795-46f8-9d86-42137a27593b", "source_name": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20230420-0004/" }, { "external_id": null, "id": "1106ef72-ce81-406d-856d-1958a31fc7a1", "source_name": "secalert@redhat.com", "url": "https://www.debian.org/security/2023/dsa-5402" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "vulnerability--e39380e5-74b9-5493-a04e-2e828bf55eab", "type": "Vulnerability" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:41.824Z", "updated_at": "2026-09-26T17:24:42.301Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "b97763c0-2abf-4bef-9811-4c42bd07fb29", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--2c2b3c0e-ca50-5561-aa4b-05ac575e79dd", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.250Z", "created_at": "2026-09-26T17:25:13.379Z", "modified": "2026-10-08T18:51:04.375Z", "updated_at": "2026-10-08T18:51:04.375Z" }, "description_available": false, "entity_type": "Indicator", "id": "bf58a30e-16c5-47ae-a83a-09c14f56acdb", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--f74de085-0c41-5b4d-a893-f1c36a38a7a0", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:41.041Z", "updated_at": "2026-09-26T17:24:41.547Z" }, "description_available": false, "entity_type": "Url", "id": "c2d9074f-2a05-4794-afeb-528ead1b3d8c", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--d8eaa6d6-72a7-5885-b9aa-fc1de8f600f4", "type": "Url" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:43.575Z", "updated_at": "2026-09-26T17:24:43.956Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "c5a84d4a-2769-45c8-b4b3-218f768a74b7", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--ec27add3-476c-597d-85ba-e251254a1db6", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.190Z", "created_at": "2026-09-26T17:24:52.867Z", "modified": "2026-10-08T18:51:03.738Z", "updated_at": "2026-10-08T18:51:03.738Z" }, "description_available": false, "entity_type": "Indicator", "id": "d11c4370-fcc8-46b4-b0c3-4838fc4f819f", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--d1424973-df20-599b-b4fc-63a240e9442c", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:29.603Z", "updated_at": "2026-09-26T17:24:30.014Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "d612f5d1-96c4-44c2-9ae8-26f0b716ca03", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--05e0e8ac-57a1-529b-a068-b393a59bc1b9", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:43.729Z", "updated_at": "2026-09-26T17:24:44.158Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "e2668dc1-f28e-4cfa-9ed8-37a1e2817b74", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--aa2250f0-3dbe-5433-8c1a-726bf85c7075", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:28.964Z", "updated_at": "2026-09-26T17:24:29.525Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "e98896ff-fbfe-4a6e-b947-3fd6588aabac", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--f7d5aa4d-88a0-5f88-b929-455174c50827", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:30.450Z", "updated_at": "2026-09-26T17:24:30.654Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "ed51775b-24c6-42ad-9791-2047ed0adaef", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "domain-name--804e86da-7728-5004-b3b4-af78d2b6e0b9", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.233Z", "created_at": "2026-09-26T17:25:07.339Z", "modified": "2026-09-26T17:27:48.879Z", "updated_at": "2026-09-26T17:27:48.879Z" }, "description_available": false, "entity_type": "Indicator", "id": "eef5b275-bdaf-442c-9420-0e50d3b1d209", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--3ba5afdd-f7c5-50ed-8e00-b818d2979786", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:27.818Z", "updated_at": "2026-09-26T17:24:28.948Z" }, "description_available": false, "entity_type": "Url", "id": "f0534ba8-81af-420d-9b3f-8e842073e749", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "url--8ca2c8ff-c55a-5477-9a5c-f4db37384cf2", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.198Z", "created_at": "2026-09-26T17:24:56.997Z", "modified": "2026-09-26T17:25:24.618Z", "updated_at": "2026-09-26T17:25:24.618Z" }, "description_available": false, "entity_type": "Indicator", "id": "f320ccf9-9abe-467d-a095-63238d88eab8", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--b26191f2-d2b4-52dc-ab16-6d2022caeb7a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.240Z", "created_at": "2026-09-26T17:25:09.177Z", "modified": "2026-09-26T17:29:08.510Z", "updated_at": "2026-09-26T17:29:08.510Z" }, "description_available": false, "entity_type": "Indicator", "id": "fef8b9f9-4a39-48f7-a2fd-1b3a8d537d49", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "indicator--2ccb8fae-ba50-5ceb-8c59-557e614ff9ac", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T17:24:21.612Z", "updated_at": "2026-09-26T17:24:21.989Z" }, "description_available": false, "entity_type": "StixFile", "id": "ff4432d3-67f4-4c00-8c4e-d09f0e6e1021", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "file--b948b709-2e2e-5b58-b7d9-acad78ff5fb7", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.246Z", "created_at": "2026-09-26T17:30:17.183Z", "modified": "2026-09-26T17:30:17.537Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:17.537Z" }, "description_available": false, "entity_type": "based-on", "fromId": "accbb3ce-9b72-4ef5-8419-14894011e8db", "from_id": "accbb3ce-9b72-4ef5-8419-14894011e8db", "from_name": null, "from_type": "Indicator", "id": "05e7236d-1fa0-4f3a-a6f9-32c517184948", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--f50778e8-22ba-5e5f-8e6e-be347f974314", "toId": "49db1e41-fcc0-463c-ad4b-5d2cccbbd4c6", "to_id": "49db1e41-fcc0-463c-ad4b-5d2cccbbd4c6", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.203Z", "created_at": "2026-09-26T17:30:01.158Z", "modified": "2026-09-26T17:30:02.874Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:02.874Z" }, "description_available": false, "entity_type": "based-on", "fromId": "73ab5033-2076-463d-95dd-25d00cb6b451", "from_id": "73ab5033-2076-463d-95dd-25d00cb6b451", "from_name": null, "from_type": "Indicator", "id": "0f9ffef4-4b6f-4ffd-9ca1-ba81b87f9631", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--34b55178-3636-5887-b157-2fcb0ebb7049", "toId": "aafc163d-9691-4c53-8426-49c333e34704", "to_id": "aafc163d-9691-4c53-8426-49c333e34704", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.191Z", "created_at": "2026-09-26T17:29:57.234Z", "modified": "2026-09-26T17:29:59.129Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:29:59.129Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d11c4370-fcc8-46b4-b0c3-4838fc4f819f", "from_id": "d11c4370-fcc8-46b4-b0c3-4838fc4f819f", "from_name": null, "from_type": "Indicator", "id": "131b8c3b-552a-4264-bc3a-047ae14b7a73", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--4d6ba639-5ea4-5c5c-80d5-84a4587d842a", "toId": "0c306412-8fca-45c6-946f-89641c8c018b", "to_id": "0c306412-8fca-45c6-946f-89641c8c018b", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.261Z", "created_at": "2026-09-26T17:30:19.491Z", "modified": "2026-09-26T17:30:19.949Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:19.949Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b4e4f97b-9d17-4008-a862-26ba24205410", "from_id": "b4e4f97b-9d17-4008-a862-26ba24205410", "from_name": null, "from_type": "Indicator", "id": "1d1619f1-4ae4-4a03-a4ff-6de7a8646ac6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--2ef7dbaf-6fc0-5d80-9820-4ada49a3812e", "toId": "e2668dc1-f28e-4cfa-9ed8-37a1e2817b74", "to_id": "e2668dc1-f28e-4cfa-9ed8-37a1e2817b74", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.217Z", "created_at": "2026-09-26T17:30:06.700Z", "modified": "2026-09-26T17:30:07.784Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:07.784Z" }, "description_available": false, "entity_type": "based-on", "fromId": "93cdcbe7-f284-4139-b3f3-0d3d97902aff", "from_id": "93cdcbe7-f284-4139-b3f3-0d3d97902aff", "from_name": null, "from_type": "Indicator", "id": "34df173d-07e2-4a19-a730-a1f426f84d92", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--12643324-ca94-5993-84b8-e47c0b0268b7", "toId": "e98896ff-fbfe-4a6e-b947-3fd6588aabac", "to_id": "e98896ff-fbfe-4a6e-b947-3fd6588aabac", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.239Z", "created_at": "2026-09-26T17:30:14.678Z", "modified": "2026-09-26T17:30:16.742Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:16.742Z" }, "description_available": false, "entity_type": "based-on", "fromId": "741815c0-caa8-4792-8149-5c45f3fa23b2", "from_id": "741815c0-caa8-4792-8149-5c45f3fa23b2", "from_name": null, "from_type": "Indicator", "id": "352a3f65-941a-4a54-b235-1d453b6544fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--f81d64e2-f025-53ec-b712-ed2a1044f7a8", "toId": "5cd9003e-ba80-46b2-b61f-11d516928388", "to_id": "5cd9003e-ba80-46b2-b61f-11d516928388", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.176Z", "created_at": "2026-09-26T17:29:53.111Z", "modified": "2026-09-26T17:29:54.894Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:29:54.894Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3f398965-53b2-4e42-9582-64a3b36bf70b", "from_id": "3f398965-53b2-4e42-9582-64a3b36bf70b", "from_name": null, "from_type": "Indicator", "id": "3585b5f0-c067-44b7-acb6-75ec8c95c7e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--70165313-2511-5352-b0b5-c15829b36444", "toId": "0dd6180e-89c5-4840-88a7-6784aa9ebef6", "to_id": "0dd6180e-89c5-4840-88a7-6784aa9ebef6", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.197Z", "created_at": "2026-09-26T17:29:57.534Z", "modified": "2026-09-26T17:30:00.053Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:00.053Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7c9f831c-696e-4aeb-ac88-bc5edbf5c5ba", "from_id": "7c9f831c-696e-4aeb-ac88-bc5edbf5c5ba", "from_name": null, "from_type": "Indicator", "id": "516d1ec1-c236-445b-86b7-1b4113be2fe5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--8c1d9981-baa0-5c8b-b8d9-255772a5322c", "toId": "ff4432d3-67f4-4c00-8c4e-d09f0e6e1021", "to_id": "ff4432d3-67f4-4c00-8c4e-d09f0e6e1021", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.219Z", "created_at": "2026-09-26T17:30:06.694Z", "modified": "2026-09-26T17:30:07.783Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:07.783Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3885b33e-2b03-45f1-aefc-534783d39ec2", "from_id": "3885b33e-2b03-45f1-aefc-534783d39ec2", "from_name": null, "from_type": "Indicator", "id": "5333740d-43c1-4ab2-8ebd-119718fc8107", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--24b32278-732b-56b3-b5c9-62e5edcb741a", "toId": "d612f5d1-96c4-44c2-9ae8-26f0b716ca03", "to_id": "d612f5d1-96c4-44c2-9ae8-26f0b716ca03", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.256Z", "created_at": "2026-09-26T17:30:18.731Z", "modified": "2026-09-26T17:30:19.094Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:19.094Z" }, "description_available": false, "entity_type": "based-on", "fromId": "159ee0cd-fcbf-4273-b060-252131ef1eae", "from_id": "159ee0cd-fcbf-4273-b060-252131ef1eae", "from_name": null, "from_type": "Indicator", "id": "5832df9d-973d-4064-9001-62db6f808ab6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--16ed6b79-6551-50b7-a233-f6a844ac9af7", "toId": "b97763c0-2abf-4bef-9811-4c42bd07fb29", "to_id": "b97763c0-2abf-4bef-9811-4c42bd07fb29", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.264Z", "created_at": "2026-09-26T17:30:19.787Z", "modified": "2026-09-26T17:30:20.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:20.101Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0d582fc1-ad74-4fbd-bff4-6f2c806a5efd", "from_id": "0d582fc1-ad74-4fbd-bff4-6f2c806a5efd", "from_name": null, "from_type": "Indicator", "id": "60ad846c-8e5e-4612-8ca8-3fc13a174688", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--294167c0-7cf0-52f0-938a-45a019c5c51e", "toId": "1dbfe028-2f60-48f0-b099-59f3ac18d7c0", "to_id": "1dbfe028-2f60-48f0-b099-59f3ac18d7c0", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.251Z", "created_at": "2026-09-26T17:30:17.287Z", "modified": "2026-09-26T17:30:17.916Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:17.916Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bf58a30e-16c5-47ae-a83a-09c14f56acdb", "from_id": "bf58a30e-16c5-47ae-a83a-09c14f56acdb", "from_name": null, "from_type": "Indicator", "id": "6462f332-d78d-4f48-a66a-6e5671e15d2b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--b2197ea3-8fb8-5e1f-b63c-a94fccb0a8e1", "toId": "64812fa7-76b5-404b-8b08-c5d975e9167d", "to_id": "64812fa7-76b5-404b-8b08-c5d975e9167d", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.241Z", "created_at": "2026-09-26T17:30:14.678Z", "modified": "2026-09-26T17:30:16.743Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:16.743Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fef8b9f9-4a39-48f7-a2fd-1b3a8d537d49", "from_id": "fef8b9f9-4a39-48f7-a2fd-1b3a8d537d49", "from_name": null, "from_type": "Indicator", "id": "71a0656e-dca1-4d82-8c2a-3c846a8f7450", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--6fb24680-5ace-56b7-baa9-7c9f97d6e00a", "toId": "0e467fc4-3fdf-4a84-bde8-4d4652a4df86", "to_id": "0e467fc4-3fdf-4a84-bde8-4d4652a4df86", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.186Z", "created_at": "2026-09-26T17:29:55.574Z", "modified": "2026-09-26T17:29:55.970Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:29:55.970Z" }, "description_available": false, "entity_type": "based-on", "fromId": "05a76cad-5895-4fa8-8706-04e1ef78e939", "from_id": "05a76cad-5895-4fa8-8706-04e1ef78e939", "from_name": null, "from_type": "Indicator", "id": "72ac991c-f745-4917-a96b-7386e02ffc1d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--a2c5bef4-7589-5031-979d-fc6a3e06b04f", "toId": "a02693d1-985b-4dbd-b7c7-1474c25f88f6", "to_id": "a02693d1-985b-4dbd-b7c7-1474c25f88f6", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.188Z", "created_at": "2026-09-26T17:29:55.762Z", "modified": "2026-09-26T17:29:56.374Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:29:56.374Z" }, "description_available": false, "entity_type": "based-on", "fromId": "67adbfb3-4aac-427c-9a39-77715c32c2b3", "from_id": "67adbfb3-4aac-427c-9a39-77715c32c2b3", "from_name": null, "from_type": "Indicator", "id": "72c16802-ca0e-44d7-aafb-e18ab3ecdf96", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--69ac880d-1ee2-5223-89e8-e7838eaaf0d2", "toId": "03d461d5-9e1e-49c7-93ff-1791e4beb133", "to_id": "03d461d5-9e1e-49c7-93ff-1791e4beb133", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.212Z", "created_at": "2026-09-26T17:30:03.632Z", "modified": "2026-09-26T17:30:05.539Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:05.539Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a09dde4c-bf08-427b-97ad-62eb0f2fcd3c", "from_id": "a09dde4c-bf08-427b-97ad-62eb0f2fcd3c", "from_name": null, "from_type": "Indicator", "id": "78dc2a1b-7a4c-40f5-9659-636fbc743a11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--48050ea4-423d-506f-859c-c7419df45d7e", "toId": "5e938570-e7ce-4a6c-b98f-4f1992d2c736", "to_id": "5e938570-e7ce-4a6c-b98f-4f1992d2c736", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-11T08:27:25.399Z", "created_at": "2026-08-11T21:37:51.648Z", "modified": "2026-08-11T21:37:52.215Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T21:37:52.215Z" }, "description_available": false, "entity_type": "based-on", "fromId": "91dc4c20-28ea-429f-83de-e8d2fdcbdeed", "from_id": "91dc4c20-28ea-429f-83de-e8d2fdcbdeed", "from_name": null, "from_type": "Indicator", "id": "7c5b0ba0-09bd-4619-aa35-c0ed2dce79bb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--634e05d9-f33e-58be-a193-1ea73d958ea7", "toId": "5476f2a6-7def-474c-950d-7db651f042eb", "to_id": "5476f2a6-7def-474c-950d-7db651f042eb", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.249Z", "created_at": "2026-09-26T17:30:17.286Z", "modified": "2026-09-26T17:30:17.915Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:17.915Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b319be11-2488-4a56-8e9b-95fb769b16e0", "from_id": "b319be11-2488-4a56-8e9b-95fb769b16e0", "from_name": null, "from_type": "Indicator", "id": "7c7036ce-5123-4840-bcbe-11ea56decd34", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--a0c28002-447d-58db-ba31-c013631b1f29", "toId": "c2d9074f-2a05-4794-afeb-528ead1b3d8c", "to_id": "c2d9074f-2a05-4794-afeb-528ead1b3d8c", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.181Z", "created_at": "2026-09-26T17:29:54.873Z", "modified": "2026-09-26T17:29:55.370Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:29:55.370Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5f9be0ce-05c9-419f-978c-adae3d6304c6", "from_id": "5f9be0ce-05c9-419f-978c-adae3d6304c6", "from_name": null, "from_type": "Indicator", "id": "99422907-5b0e-4b5c-afe6-a276bf215a8d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--d973a971-9948-559d-8ac6-40bf50f94427", "toId": "2f2f5c88-1cc8-4bc9-ab34-5020889c4800", "to_id": "2f2f5c88-1cc8-4bc9-ab34-5020889c4800", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.200Z", "created_at": "2026-09-26T17:30:01.151Z", "modified": "2026-09-26T17:30:02.611Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:02.611Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f320ccf9-9abe-467d-a095-63238d88eab8", "from_id": "f320ccf9-9abe-467d-a095-63238d88eab8", "from_name": null, "from_type": "Indicator", "id": "9a18e640-f08a-4f18-a459-16c754967b89", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--dfef090e-7e5a-53f7-8719-b706a7deef4d", "toId": "650f9078-5cdb-424e-811a-9b8f051fe5ab", "to_id": "650f9078-5cdb-424e-811a-9b8f051fe5ab", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.206Z", "created_at": "2026-09-26T17:30:01.629Z", "modified": "2026-09-26T17:30:03.057Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:03.057Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2035a3b1-a68b-4267-9b8c-bf86ae145b29", "from_id": "2035a3b1-a68b-4267-9b8c-bf86ae145b29", "from_name": null, "from_type": "Indicator", "id": "af049aa1-16dc-4a15-89c1-ad467fc80c35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--8d9925f3-7372-5dfe-a634-f7b1ea1ff0d7", "toId": "56dc31c3-3f81-4202-84f4-8b7c544df342", "to_id": "56dc31c3-3f81-4202-84f4-8b7c544df342", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.227Z", "created_at": "2026-09-26T17:30:08.523Z", "modified": "2026-09-26T17:30:09.113Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:09.113Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7ce786ac-b72a-4437-b72e-1d43d685e060", "from_id": "7ce786ac-b72a-4437-b72e-1d43d685e060", "from_name": null, "from_type": "Indicator", "id": "b0e71d2d-465a-4368-a833-865bc289efaf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--8f0f9752-b53c-5044-bf1f-70ab06c60a06", "toId": "3010da83-1ddb-473a-bb78-6257c5a76e96", "to_id": "3010da83-1ddb-473a-bb78-6257c5a76e96", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.232Z", "created_at": "2026-09-26T17:30:09.571Z", "modified": "2026-09-26T17:30:11.684Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:11.684Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9ec9ff98-41a8-4a9f-a28e-c37670ffbc0e", "from_id": "9ec9ff98-41a8-4a9f-a28e-c37670ffbc0e", "from_name": null, "from_type": "Indicator", "id": "b5af0912-f203-4799-9b11-5aa0b7426004", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--69cdccf5-f5dd-55ad-89c7-04a6bb02361b", "toId": "9743371a-7a52-4800-a69d-71fa61e19441", "to_id": "9743371a-7a52-4800-a69d-71fa61e19441", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.194Z", "created_at": "2026-09-26T17:29:57.227Z", "modified": "2026-09-26T17:29:58.476Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:29:58.476Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2f6166eb-a601-4c17-a522-d2b0d620e41f", "from_id": "2f6166eb-a601-4c17-a522-d2b0d620e41f", "from_name": null, "from_type": "Indicator", "id": "ce41c8a0-1913-4e2d-9d09-06c7fa458257", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--f7f32326-d972-594d-a16f-e0b8d4d3883c", "toId": "14026a51-1b25-4f88-8542-ccbe12805cde", "to_id": "14026a51-1b25-4f88-8542-ccbe12805cde", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.254Z", "created_at": "2026-09-26T17:30:18.407Z", "modified": "2026-09-26T17:30:18.855Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:18.855Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1b9a3463-e91e-45a1-ac69-581255fd585a", "from_id": "1b9a3463-e91e-45a1-ac69-581255fd585a", "from_name": null, "from_type": "Indicator", "id": "db803fda-e627-421c-a732-dca2d4603b98", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--bc303d6e-4097-5d86-b4bb-a4c51e207139", "toId": "32eba797-62ae-4775-8c5e-e11c53504ad6", "to_id": "32eba797-62ae-4775-8c5e-e11c53504ad6", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.229Z", "created_at": "2026-09-26T17:30:08.694Z", "modified": "2026-09-26T17:30:09.189Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:09.189Z" }, "description_available": false, "entity_type": "based-on", "fromId": "64bb9148-452c-4762-a4aa-0792658d7633", "from_id": "64bb9148-452c-4762-a4aa-0792658d7633", "from_name": null, "from_type": "Indicator", "id": "ddf0e766-4e6f-461e-8ef0-894ce808d9d5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--ce45c076-9ce7-5bd3-bd4c-21996a039dec", "toId": "8fa86049-1f66-4ee1-9c5b-f868279ac553", "to_id": "8fa86049-1f66-4ee1-9c5b-f868279ac553", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.236Z", "created_at": "2026-09-26T17:30:10.751Z", "modified": "2026-09-26T17:30:14.470Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:14.470Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0a2bcf3c-c80b-4abb-a175-4195f2754771", "from_id": "0a2bcf3c-c80b-4abb-a175-4195f2754771", "from_name": null, "from_type": "Indicator", "id": "dfa72a4f-57e1-4953-8ea5-49b302946b1a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--0fc3fc4a-891d-52db-9691-5e77022deeb7", "toId": "942951ea-3ad0-489b-86eb-7601012f54a4", "to_id": "942951ea-3ad0-489b-86eb-7601012f54a4", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.184Z", "created_at": "2026-09-26T17:29:55.574Z", "modified": "2026-09-26T17:29:56.209Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:29:56.209Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8ed241be-5532-49d7-a61a-3bee8659aef4", "from_id": "8ed241be-5532-49d7-a61a-3bee8659aef4", "from_name": null, "from_type": "Indicator", "id": "e2252da4-be0a-4d85-af82-6dd808f0fc59", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--6ae79659-31be-5e1c-ab8e-165a6858e862", "toId": "342b8519-5d30-4792-83a0-b80578b43743", "to_id": "342b8519-5d30-4792-83a0-b80578b43743", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.209Z", "created_at": "2026-09-26T17:30:03.635Z", "modified": "2026-09-26T17:30:05.540Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:05.540Z" }, "description_available": false, "entity_type": "based-on", "fromId": "846d37ab-6fab-426a-8262-8bafaf05d05a", "from_id": "846d37ab-6fab-426a-8262-8bafaf05d05a", "from_name": null, "from_type": "Indicator", "id": "e4d3e2ad-8dd8-4f44-a34d-7f76624b88ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--32406d81-6125-5061-a997-35f362d51e0d", "toId": "2506ffd1-9604-4e55-b3c2-7ba2ef7f201d", "to_id": "2506ffd1-9604-4e55-b3c2-7ba2ef7f201d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.222Z", "created_at": "2026-09-26T17:30:07.575Z", "modified": "2026-09-26T17:30:08.197Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:08.197Z" }, "description_available": false, "entity_type": "based-on", "fromId": "06f0cfcf-3486-4827-a115-535d99c7f269", "from_id": "06f0cfcf-3486-4827-a115-535d99c7f269", "from_name": null, "from_type": "Indicator", "id": "ecf8c751-da6a-4a2b-9720-24355f279daa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--e524ea25-a5fb-5960-ad1b-c490afebd3ad", "toId": "729b8218-14a6-4aec-9fe9-a58c70187fd5", "to_id": "729b8218-14a6-4aec-9fe9-a58c70187fd5", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.259Z", "created_at": "2026-09-26T17:30:18.735Z", "modified": "2026-09-26T17:30:19.214Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:19.214Z" }, "description_available": false, "entity_type": "based-on", "fromId": "445fab51-9dd0-46b8-8b55-afe75cf2b237", "from_id": "445fab51-9dd0-46b8-8b55-afe75cf2b237", "from_name": null, "from_type": "Indicator", "id": "ed61ac4a-5bf6-43ff-b88f-22f2303f134f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--651feb94-4eac-552b-92c8-75100933cdee", "toId": "c5a84d4a-2769-45c8-b4b3-218f768a74b7", "to_id": "c5a84d4a-2769-45c8-b4b3-218f768a74b7", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.234Z", "created_at": "2026-09-26T17:30:09.571Z", "modified": "2026-09-26T17:30:11.571Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:11.571Z" }, "description_available": false, "entity_type": "based-on", "fromId": "eef5b275-bdaf-442c-9420-0e50d3b1d209", "from_id": "eef5b275-bdaf-442c-9420-0e50d3b1d209", "from_name": null, "from_type": "Indicator", "id": "edac8abf-8e7e-42f7-a986-bc205f080a48", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--767a33f3-a4da-5edb-9984-c191002ca7d8", "toId": "61ee1ee2-53e4-47cc-a6b1-9fbc28a95094", "to_id": "61ee1ee2-53e4-47cc-a6b1-9fbc28a95094", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.214Z", "created_at": "2026-09-26T17:30:04.297Z", "modified": "2026-09-26T17:30:06.259Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:06.259Z" }, "description_available": false, "entity_type": "based-on", "fromId": "84dd68ca-9bc9-439e-b47e-63cf1f3cfb98", "from_id": "84dd68ca-9bc9-439e-b47e-63cf1f3cfb98", "from_name": null, "from_type": "Indicator", "id": "ef3195c3-4043-4b8e-8d57-f68a5ba4e283", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--8162f131-13ac-5276-afb3-d22b34563f7c", "toId": "f0534ba8-81af-420d-9b3f-8e842073e749", "to_id": "f0534ba8-81af-420d-9b3f-8e842073e749", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.243Z", "created_at": "2026-09-26T17:30:15.011Z", "modified": "2026-09-26T17:30:16.744Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:16.744Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b54a2e46-e706-45d7-ae69-30810a70e29c", "from_id": "b54a2e46-e706-45d7-ae69-30810a70e29c", "from_name": null, "from_type": "Indicator", "id": "f0f0d548-075b-4104-8baa-54629fb79ad4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--91131392-548a-5aff-97b1-269f210f8a71", "toId": "1b2f2c77-a170-48c8-ab41-a6389067ffb1", "to_id": "1b2f2c77-a170-48c8-ab41-a6389067ffb1", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.224Z", "created_at": "2026-09-26T17:30:08.520Z", "modified": "2026-09-26T17:30:08.846Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:08.846Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9247962b-e991-4b55-8ac3-413d503e4d45", "from_id": "9247962b-e991-4b55-8ac3-413d503e4d45", "from_name": null, "from_type": "Indicator", "id": "fce0c00d-1d02-47cb-8849-bc694bb16d70", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--84feea2c-bde7-5bff-bfd6-ea7e3597ef76", "toId": "ed51775b-24c6-42ad-9791-2047ed0adaef", "to_id": "ed51775b-24c6-42ad-9791-2047ed0adaef", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:00.266Z", "created_at": "2026-09-26T17:30:19.787Z", "modified": "2026-09-26T17:30:20.102Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T17:30:20.102Z" }, "description_available": false, "entity_type": "based-on", "fromId": "05e341df-1d25-4972-abf7-bfb0ab1aee69", "from_id": "05e341df-1d25-4972-abf7-bfb0ab1aee69", "from_name": null, "from_type": "Indicator", "id": "ffa5ebb2-6377-4345-aed5-bd67497f046b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "standard_id": "relationship--a5134611-0f6a-5abc-b0b4-051ae98c8331", "toId": "7c6ba3a4-1ebe-4fd8-8c00-fb56908ca995", "to_id": "7c6ba3a4-1ebe-4fd8-8c00-fb56908ca995", "to_name": null, "to_type": "DomainName" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3262d48df5d75e34[.]shop", "description_available": false, "object_id": "93cdcbe7-f284-4139-b3f3-0d3d97902aff", "object_ids": [ "93cdcbe7-f284-4139-b3f3-0d3d97902aff", "e98896ff-fbfe-4a6e-b947-3fd6588aabac" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "93cdcbe7-f284-4139-b3f3-0d3d97902aff", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "3262d48df5d75e34.shop" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "e98896ff-fbfe-4a6e-b947-3fd6588aabac", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3262d48df5d75e34.shop" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "3262d48df5d75e34.shop" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "45a3158594d6ba76[.]fun", "description_available": false, "object_id": "3885b33e-2b03-45f1-aefc-534783d39ec2", "object_ids": [ "3885b33e-2b03-45f1-aefc-534783d39ec2", "d612f5d1-96c4-44c2-9ae8-26f0b716ca03" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3885b33e-2b03-45f1-aefc-534783d39ec2", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "45a3158594d6ba76.fun" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "d612f5d1-96c4-44c2-9ae8-26f0b716ca03", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "45a3158594d6ba76.fun" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "45a3158594d6ba76.fun" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "67b3ac3e45812153[.]fun", "description_available": false, "object_id": "06f0cfcf-3486-4827-a115-535d99c7f269", "object_ids": [ "06f0cfcf-3486-4827-a115-535d99c7f269", "729b8218-14a6-4aec-9fe9-a58c70187fd5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "06f0cfcf-3486-4827-a115-535d99c7f269", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "67b3ac3e45812153.fun" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "729b8218-14a6-4aec-9fe9-a58c70187fd5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "67b3ac3e45812153.fun" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "67b3ac3e45812153.fun" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "82d35f9b891c987a[.]fun", "description_available": false, "object_id": "9247962b-e991-4b55-8ac3-413d503e4d45", "object_ids": [ "9247962b-e991-4b55-8ac3-413d503e4d45", "ed51775b-24c6-42ad-9791-2047ed0adaef" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9247962b-e991-4b55-8ac3-413d503e4d45", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "82d35f9b891c987a.fun" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "ed51775b-24c6-42ad-9791-2047ed0adaef", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "82d35f9b891c987a.fun" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "82d35f9b891c987a.fun" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9082b2a18f2e00fe[.]fun", "description_available": false, "object_id": "7ce786ac-b72a-4437-b72e-1d43d685e060", "object_ids": [ "3010da83-1ddb-473a-bb78-6257c5a76e96", "7ce786ac-b72a-4437-b72e-1d43d685e060" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7ce786ac-b72a-4437-b72e-1d43d685e060", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "9082b2a18f2e00fe.fun" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "3010da83-1ddb-473a-bb78-6257c5a76e96", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9082b2a18f2e00fe.fun" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "9082b2a18f2e00fe.fun" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "90happymoney[.]top", "description_available": false, "object_id": "159ee0cd-fcbf-4273-b060-252131ef1eae", "object_ids": [ "159ee0cd-fcbf-4273-b060-252131ef1eae", "b97763c0-2abf-4bef-9811-4c42bd07fb29" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "159ee0cd-fcbf-4273-b060-252131ef1eae", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "90happymoney.top" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "b97763c0-2abf-4bef-9811-4c42bd07fb29", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "90happymoney.top" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "90happymoney.top" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cleearpeyak[.]online", "description_available": false, "object_id": "445fab51-9dd0-46b8-8b55-afe75cf2b237", "object_ids": [ "445fab51-9dd0-46b8-8b55-afe75cf2b237", "c5a84d4a-2769-45c8-b4b3-218f768a74b7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "445fab51-9dd0-46b8-8b55-afe75cf2b237", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "cleearpeyak.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "c5a84d4a-2769-45c8-b4b3-218f768a74b7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cleearpeyak.online" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "cleearpeyak.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ddcd62e16a428c8e[.]shop", "description_available": false, "object_id": "64bb9148-452c-4762-a4aa-0792658d7633", "object_ids": [ "64bb9148-452c-4762-a4aa-0792658d7633", "8fa86049-1f66-4ee1-9c5b-f868279ac553" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "64bb9148-452c-4762-a4aa-0792658d7633", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "ddcd62e16a428c8e.shop" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "8fa86049-1f66-4ee1-9c5b-f868279ac553", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ddcd62e16a428c8e.shop" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "ddcd62e16a428c8e.shop" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "folfdighdd[.]xyz", "description_available": false, "object_id": "b4e4f97b-9d17-4008-a862-26ba24205410", "object_ids": [ "b4e4f97b-9d17-4008-a862-26ba24205410", "e2668dc1-f28e-4cfa-9ed8-37a1e2817b74" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b4e4f97b-9d17-4008-a862-26ba24205410", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "folfdighdd.xyz" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "e2668dc1-f28e-4cfa-9ed8-37a1e2817b74", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "folfdighdd.xyz" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "folfdighdd.xyz" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hivinest[.]online", "description_available": false, "object_id": "9ec9ff98-41a8-4a9f-a28e-c37670ffbc0e", "object_ids": [ "9743371a-7a52-4800-a69d-71fa61e19441", "9ec9ff98-41a8-4a9f-a28e-c37670ffbc0e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9ec9ff98-41a8-4a9f-a28e-c37670ffbc0e", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "hivinest.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "9743371a-7a52-4800-a69d-71fa61e19441", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "hivinest.online" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "hivinest.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "insinght[.]site", "description_available": false, "object_id": "0d582fc1-ad74-4fbd-bff4-6f2c806a5efd", "object_ids": [ "0d582fc1-ad74-4fbd-bff4-6f2c806a5efd", "1dbfe028-2f60-48f0-b099-59f3ac18d7c0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0d582fc1-ad74-4fbd-bff4-6f2c806a5efd", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "insinght.site" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "1dbfe028-2f60-48f0-b099-59f3ac18d7c0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "insinght.site" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "insinght.site" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "lanhd6549tdhse[.]top", "description_available": false, "object_id": "3f398965-53b2-4e42-9582-64a3b36bf70b", "object_ids": [ "0dd6180e-89c5-4840-88a7-6784aa9ebef6", "3f398965-53b2-4e42-9582-64a3b36bf70b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3f398965-53b2-4e42-9582-64a3b36bf70b", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "lanhd6549tdhse.top" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "0dd6180e-89c5-4840-88a7-6784aa9ebef6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "lanhd6549tdhse.top" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "lanhd6549tdhse.top" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "onemm[.]net", "description_available": false, "object_id": "05e341df-1d25-4972-abf7-bfb0ab1aee69", "object_ids": [ "05e341df-1d25-4972-abf7-bfb0ab1aee69", "7c6ba3a4-1ebe-4fd8-8c00-fb56908ca995" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "05e341df-1d25-4972-abf7-bfb0ab1aee69", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "onemm.net" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "7c6ba3a4-1ebe-4fd8-8c00-fb56908ca995", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "onemm.net" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "onemm.net" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "pleasewaitcenter[.]top", "description_available": false, "object_id": "eef5b275-bdaf-442c-9420-0e50d3b1d209", "object_ids": [ "61ee1ee2-53e4-47cc-a6b1-9fbc28a95094", "eef5b275-bdaf-442c-9420-0e50d3b1d209" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "eef5b275-bdaf-442c-9420-0e50d3b1d209", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "pleasewaitcenter.top" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "61ee1ee2-53e4-47cc-a6b1-9fbc28a95094", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "pleasewaitcenter.top" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "pleasewaitcenter.top" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "skaybolt[.]online", "description_available": false, "object_id": "0a2bcf3c-c80b-4abb-a175-4195f2754771", "object_ids": [ "0a2bcf3c-c80b-4abb-a175-4195f2754771", "942951ea-3ad0-489b-86eb-7601012f54a4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0a2bcf3c-c80b-4abb-a175-4195f2754771", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "skaybolt.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "942951ea-3ad0-489b-86eb-7601012f54a4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "skaybolt.online" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "skaybolt.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "truieparth[.]online", "description_available": false, "object_id": "741815c0-caa8-4792-8149-5c45f3fa23b2", "object_ids": [ "5cd9003e-ba80-46b2-b61f-11d516928388", "741815c0-caa8-4792-8149-5c45f3fa23b2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "741815c0-caa8-4792-8149-5c45f3fa23b2", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "truieparth.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "5cd9003e-ba80-46b2-b61f-11d516928388", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "truieparth.online" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "truieparth.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "veruisuealx[.]xyz", "description_available": false, "object_id": "fef8b9f9-4a39-48f7-a2fd-1b3a8d537d49", "object_ids": [ "0e467fc4-3fdf-4a84-bde8-4d4652a4df86", "fef8b9f9-4a39-48f7-a2fd-1b3a8d537d49" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fef8b9f9-4a39-48f7-a2fd-1b3a8d537d49", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "veruisuealx.xyz" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "0e467fc4-3fdf-4a84-bde8-4d4652a4df86", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "veruisuealx.xyz" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "domain", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-12-30T04:10:51.260Z", "validity_status": "active", "value": "veruisuealx.xyz" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e", "description_available": false, "object_id": "2f6166eb-a601-4c17-a522-d2b0d620e41f", "object_ids": [ "14026a51-1b25-4f88-8542-ccbe12805cde", "2f6166eb-a601-4c17-a522-d2b0d620e41f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2f6166eb-a601-4c17-a522-d2b0d620e41f", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "14026a51-1b25-4f88-8542-ccbe12805cde", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "sha256", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "03a1d2eca771a276ac9c29a4bf219d31beb20848998cacda8b06375bd2795b10", "description_available": false, "object_id": "7c9f831c-696e-4aeb-ac88-bc5edbf5c5ba", "object_ids": [ "7c9f831c-696e-4aeb-ac88-bc5edbf5c5ba", "ff4432d3-67f4-4c00-8c4e-d09f0e6e1021" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7c9f831c-696e-4aeb-ac88-bc5edbf5c5ba", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "03a1d2eca771a276ac9c29a4bf219d31beb20848998cacda8b06375bd2795b10" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ff4432d3-67f4-4c00-8c4e-d09f0e6e1021", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "03a1d2eca771a276ac9c29a4bf219d31beb20848998cacda8b06375bd2795b10" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "sha256", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "03a1d2eca771a276ac9c29a4bf219d31beb20848998cacda8b06375bd2795b10" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1", "description_available": false, "object_id": "f320ccf9-9abe-467d-a095-63238d88eab8", "object_ids": [ "650f9078-5cdb-424e-811a-9b8f051fe5ab", "f320ccf9-9abe-467d-a095-63238d88eab8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f320ccf9-9abe-467d-a095-63238d88eab8", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "650f9078-5cdb-424e-811a-9b8f051fe5ab", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "sha256", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11", "description_available": false, "object_id": "73ab5033-2076-463d-95dd-25d00cb6b451", "object_ids": [ "73ab5033-2076-463d-95dd-25d00cb6b451", "aafc163d-9691-4c53-8426-49c333e34704" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "73ab5033-2076-463d-95dd-25d00cb6b451", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "aafc163d-9691-4c53-8426-49c333e34704", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "sha256", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939", "description_available": false, "object_id": "2035a3b1-a68b-4267-9b8c-bf86ae145b29", "object_ids": [ "2035a3b1-a68b-4267-9b8c-bf86ae145b29", "56dc31c3-3f81-4202-84f4-8b7c544df342" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2035a3b1-a68b-4267-9b8c-bf86ae145b29", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "56dc31c3-3f81-4202-84f4-8b7c544df342", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "sha256", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a", "description_available": false, "object_id": "846d37ab-6fab-426a-8262-8bafaf05d05a", "object_ids": [ "2506ffd1-9604-4e55-b3c2-7ba2ef7f201d", "846d37ab-6fab-426a-8262-8bafaf05d05a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "846d37ab-6fab-426a-8262-8bafaf05d05a", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "2506ffd1-9604-4e55-b3c2-7ba2ef7f201d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "sha256", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a", "description_available": false, "object_id": "a09dde4c-bf08-427b-97ad-62eb0f2fcd3c", "object_ids": [ "5e938570-e7ce-4a6c-b98f-4f1992d2c736", "a09dde4c-bf08-427b-97ad-62eb0f2fcd3c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a09dde4c-bf08-427b-97ad-62eb0f2fcd3c", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5e938570-e7ce-4a6c-b98f-4f1992d2c736", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "sha256", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2027-07-06T00:25:27.557Z", "validity_status": "active", "value": "cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//1rpc[.]io/matic", "description_available": false, "object_id": "91dc4c20-28ea-429f-83de-e8d2fdcbdeed", "object_ids": [ "5476f2a6-7def-474c-950d-7db651f042eb", "91dc4c20-28ea-429f-83de-e8d2fdcbdeed" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "91dc4c20-28ea-429f-83de-e8d2fdcbdeed", "valid_from": "2026-08-10T18:05:07.000Z", "valid_until": "2026-08-30T23:39:46.434Z", "validity_status": "revoked", "value": "http://1rpc.io/matic" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "5476f2a6-7def-474c-950d-7db651f042eb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://1rpc.io/matic" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-08-10T18:05:07.000Z", "valid_until": "2026-08-30T23:39:46.434Z", "validity_status": "revoked", "value": "http://1rpc.io/matic" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//3262d48df5d75e34[.]shop/UpdateCheck/", "description_available": false, "object_id": "b54a2e46-e706-45d7-ae69-30810a70e29c", "object_ids": [ "1b2f2c77-a170-48c8-ab41-a6389067ffb1", "b54a2e46-e706-45d7-ae69-30810a70e29c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b54a2e46-e706-45d7-ae69-30810a70e29c", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://3262d48df5d75e34.shop/UpdateCheck/" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "1b2f2c77-a170-48c8-ab41-a6389067ffb1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://3262d48df5d75e34.shop/UpdateCheck/" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://3262d48df5d75e34.shop/UpdateCheck/" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//90happymoney[.]top[:]3001/ws", "description_available": false, "object_id": "accbb3ce-9b72-4ef5-8419-14894011e8db", "object_ids": [ "49db1e41-fcc0-463c-ad4b-5d2cccbbd4c6", "accbb3ce-9b72-4ef5-8419-14894011e8db" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "accbb3ce-9b72-4ef5-8419-14894011e8db", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://90happymoney.top:3001/ws" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "49db1e41-fcc0-463c-ad4b-5d2cccbbd4c6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://90happymoney.top:3001/ws" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://90happymoney.top:3001/ws" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//ddcd62e16a428c8e[.]shop/UpdateCheck/", "description_available": false, "object_id": "b319be11-2488-4a56-8e9b-95fb769b16e0", "object_ids": [ "b319be11-2488-4a56-8e9b-95fb769b16e0", "c2d9074f-2a05-4794-afeb-528ead1b3d8c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b319be11-2488-4a56-8e9b-95fb769b16e0", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://ddcd62e16a428c8e.shop/UpdateCheck/" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "c2d9074f-2a05-4794-afeb-528ead1b3d8c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://ddcd62e16a428c8e.shop/UpdateCheck/" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://ddcd62e16a428c8e.shop/UpdateCheck/" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//gateway[.]tenderly[.]co/public/polygon", "description_available": false, "object_id": "67adbfb3-4aac-427c-9a39-77715c32c2b3", "object_ids": [ "03d461d5-9e1e-49c7-93ff-1791e4beb133", "67adbfb3-4aac-427c-9a39-77715c32c2b3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "67adbfb3-4aac-427c-9a39-77715c32c2b3", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://gateway.tenderly.co/public/polygon" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "03d461d5-9e1e-49c7-93ff-1791e4beb133", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://gateway.tenderly.co/public/polygon" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://gateway.tenderly.co/public/polygon" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//hivinest[.]online/UpdateCheck/", "description_available": false, "object_id": "bf58a30e-16c5-47ae-a83a-09c14f56acdb", "object_ids": [ "64812fa7-76b5-404b-8b08-c5d975e9167d", "bf58a30e-16c5-47ae-a83a-09c14f56acdb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bf58a30e-16c5-47ae-a83a-09c14f56acdb", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://hivinest.online/UpdateCheck/" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "64812fa7-76b5-404b-8b08-c5d975e9167d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://hivinest.online/UpdateCheck/" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://hivinest.online/UpdateCheck/" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//insinght[.]site/UpdateCheck/", "description_available": false, "object_id": "1b9a3463-e91e-45a1-ac69-581255fd585a", "object_ids": [ "1b9a3463-e91e-45a1-ac69-581255fd585a", "32eba797-62ae-4775-8c5e-e11c53504ad6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1b9a3463-e91e-45a1-ac69-581255fd585a", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://insinght.site/UpdateCheck/" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "32eba797-62ae-4775-8c5e-e11c53504ad6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://insinght.site/UpdateCheck/" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://insinght.site/UpdateCheck/" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//polygon[.]api[.]onfinality[.]io/public", "description_available": false, "object_id": "84dd68ca-9bc9-439e-b47e-63cf1f3cfb98", "object_ids": [ "84dd68ca-9bc9-439e-b47e-63cf1f3cfb98", "f0534ba8-81af-420d-9b3f-8e842073e749" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "84dd68ca-9bc9-439e-b47e-63cf1f3cfb98", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://polygon.api.onfinality.io/public" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "f0534ba8-81af-420d-9b3f-8e842073e749", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://polygon.api.onfinality.io/public" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://polygon.api.onfinality.io/public" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//polygon[.]rpc[.]subquery[.]network/public", "description_available": false, "object_id": "d11c4370-fcc8-46b4-b0c3-4838fc4f819f", "object_ids": [ "0c306412-8fca-45c6-946f-89641c8c018b", "d11c4370-fcc8-46b4-b0c3-4838fc4f819f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d11c4370-fcc8-46b4-b0c3-4838fc4f819f", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://polygon.rpc.subquery.network/public" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "0c306412-8fca-45c6-946f-89641c8c018b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://polygon.rpc.subquery.network/public" } ], "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/", "type": "url", "valid_from": "2026-09-18T13:15:43.000Z", "valid_until": "2026-10-08T18:50:22.434Z", "validity_status": "revoked", "value": "http://polygon.rpc.subquery.network/public" } ], "mentioned": [ { "confidence": 100, "evidence_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "name": "Finance", "role": "mentionné", "type": "Sector" }, { "confidence": 80, "evidence_id": "b6f12009-6799-4f3c-b9d6-98717dbe7ec7", "name": "CVE-2023-0386", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "45922536-c422-4dc8-bf93-37a124e40106", "name": "CVE-2023-44487", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "55ef43e0-ab5e-4c07-99cf-8c9d0a608ab7", "name": "CVE-2023-4911", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "1827c478-b2de-413b-9779-4754d14ae900", "name": "CVE-2024-6387", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-18T13:15:42.624Z", "created_at": "2026-09-26T17:43:21.109Z", "modified": "2026-09-26T17:43:22.219Z", "published": "2026-09-18T13:15:42.624Z", "updated_at": "2026-09-26T17:43:22.219Z" }, "description_available": true, "id": "e0ece780-ea31-48be-b702-05470464b840", "is_inferred": false, "labels": [ "banking trojan", "blockchain c2", "clickfix", "compromised websites", "etherhiding", "fakecaptcha", "polygon smart contracts" ], "lang": "en", "name": "EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-18T13:15:42.624Z", "references": [ { "external_id": null, "id": "d8abcacb-c2a8-4b51-bead-b50635305955", "source_name": "alien-vault", "url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/" }, { "external_id": "6aad397e9cc5cdabaa878d5b", "id": "b2a18934-a397-4435-95a0-22ad6236b288", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aad397e9cc5cdabaa878d5b" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/" }, "targets": [], "techniques": [], "vulnerabilities": [ "CVE-2023-0386", "CVE-2023-44487", "CVE-2023-4911", "CVE-2024-6387" ] }, "report_id": "e0ece780-ea31-48be-b702-05470464b840", "schema_version": 1, "selected_date": "2026-09-18", "source_url": "https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/" }