{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 37, "direct_entities": 94, "direct_relationships": 47, "invalid_iocs": 0, "iocs": 37, "mentioned": 0, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 20, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 0, "excluded_graph_objects": 768, "graph_complete": true, "graph_objects": 94, "graph_relationships": 47, "mitre_context_complete": true, "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "status_as_of": "2026-10-10T13:26:22+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:13.685Z", "updated_at": "2026-09-26T18:42:40.576Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "00523697-93d4-4bf5-b700-2d3a09c909d9", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--42ada1f8-bb35-55be-baff-c5b9221ca0a5", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.553Z", "created_at": "2026-09-26T18:42:42.286Z", "modified": "2026-09-26T18:45:03.986Z", "updated_at": "2026-09-26T18:45:03.986Z" }, "description_available": false, "entity_type": "Indicator", "id": "02c3a6b9-b500-44d2-b446-56e7879959d3", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--3907fa88-45a7-5c72-ae46-d173b632a354", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:12.433Z", "updated_at": "2026-09-26T18:42:32.144Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "05860a22-d046-4998-be06-07b8fde85104", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--6ae709c1-9357-5845-8f9d-590b22957452", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:16.207Z", "updated_at": "2026-09-26T18:42:45.255Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "06be6b34-b31e-4db1-a003-42e1c119ee0c", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--284c685c-a2b8-52de-acc5-40fce72395b5", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:53.133Z", "updated_at": "2026-09-26T18:42:07.053Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "08870a85-cf7b-4ef0-a58c-6015cfecd735", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--fde231b4-f306-5243-8c3c-8cd27c45bda6", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.565Z", "created_at": "2026-09-26T18:42:45.565Z", "modified": "2026-09-26T18:45:17.026Z", "updated_at": "2026-09-26T18:45:17.026Z" }, "description_available": false, "entity_type": "Indicator", "id": "0e828aed-7ade-4781-ab41-6ebcb49ea6cc", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--2695cee4-d093-5662-89a0-cc5b709f432f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.555Z", "created_at": "2026-09-26T18:42:43.121Z", "modified": "2026-09-26T18:45:10.251Z", "updated_at": "2026-09-26T18:45:10.251Z" }, "description_available": false, "entity_type": "Indicator", "id": "0e880342-2986-446f-b3e8-f1f7b48b44a7", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--7fe8b002-a10a-5ab8-96a9-eda7df745376", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.617Z", "created_at": "2026-09-26T18:43:00.803Z", "modified": "2026-09-26T18:46:04.079Z", "updated_at": "2026-09-26T18:46:04.079Z" }, "description_available": false, "entity_type": "Indicator", "id": "0fab30cd-0a7b-4523-8ad5-0350ae6a3558", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--b634783c-ba73-5252-b9d6-bca07401ea5d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.601Z", "created_at": "2026-09-26T18:42:56.472Z", "modified": "2026-09-26T18:45:51.587Z", "updated_at": "2026-09-26T18:45:51.587Z" }, "description_available": false, "entity_type": "Indicator", "id": "16183ca5-dbcb-4f23-990b-11f55413cd7b", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--9d2c9c5d-cc39-519d-9d58-46c0106886c7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.513Z", "created_at": "2026-09-26T18:42:28.645Z", "modified": "2026-09-26T18:43:21.232Z", "updated_at": "2026-09-26T18:43:21.232Z" }, "description_available": false, "entity_type": "Indicator", "id": "199c5276-8916-46fa-bcc8-b4b293473165", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--26329a61-1b18-5d12-9f01-64b03690f739", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.567Z", "created_at": "2026-09-26T18:42:45.660Z", "modified": "2026-09-26T18:45:18.966Z", "updated_at": "2026-09-26T18:45:18.966Z" }, "description_available": false, "entity_type": "Indicator", "id": "1a7c9ffb-fb7f-49bd-9057-ad42837beb18", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--ab5d8be7-5877-5b0d-87fa-b28ecb373258", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:19.923Z", "updated_at": "2026-09-26T18:43:01.204Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "1cccb83c-3565-4eb2-9f29-9b8cb0aeadf7", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--ed74c410-89b1-5746-8bc3-a3d5f302f573", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:14.246Z", "updated_at": "2026-09-26T18:42:42.293Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "1e9123c6-5ea9-41fa-a344-92cc30d52ff1", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--372120fe-33f6-5200-acf3-21876f101fc1", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.545Z", "created_at": "2026-09-26T18:42:40.777Z", "modified": "2026-09-26T18:44:33.546Z", "updated_at": "2026-09-26T18:44:33.546Z" }, "description_available": false, "entity_type": "Indicator", "id": "1ed853ad-9369-4364-a8af-b554b9567871", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--21d8fc53-c983-5f94-b63c-fc0ddc1fec67", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.588Z", "created_at": "2026-09-26T18:42:50.944Z", "modified": "2026-09-26T18:45:37.793Z", "updated_at": "2026-09-26T18:45:37.793Z" }, "description_available": false, "entity_type": "Indicator", "id": "25bc00c0-3a98-4573-b418-7260aa16c443", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--661311fd-f934-5592-9aa1-2680700b2e15", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.606Z", "created_at": "2026-09-26T18:42:57.385Z", "modified": "2026-09-26T18:45:55.751Z", "updated_at": "2026-09-26T18:45:55.751Z" }, "description_available": false, "entity_type": "Indicator", "id": "28b14970-5fa3-428b-a522-d79d1897f39c", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--57827b6b-8038-539a-9f61-5d42de9a5702", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.516Z", "created_at": "2026-09-26T18:42:29.720Z", "modified": "2026-09-26T18:43:24.834Z", "updated_at": "2026-09-26T18:43:24.834Z" }, "description_available": false, "entity_type": "Indicator", "id": "28f920f3-2ed6-418c-b0fe-6693bbab376b", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--1865a0e0-bb43-5408-a6ac-1da1befd430d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.615Z", "created_at": "2026-09-26T18:43:00.620Z", "modified": "2026-09-26T18:46:01.559Z", "updated_at": "2026-09-26T18:46:01.559Z" }, "description_available": false, "entity_type": "Indicator", "id": "2cce5a19-792d-4f64-9d8e-6f83e12b9005", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--e599b77c-2bb5-5bcb-889b-e135cbd0a62d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.562Z", "created_at": "2026-09-26T18:42:45.462Z", "modified": "2026-09-26T18:45:21.893Z", "updated_at": "2026-09-26T18:45:21.893Z" }, "description_available": false, "entity_type": "Indicator", "id": "2f063633-17cc-4772-b674-9afc392c59e0", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--457062d0-9ed0-52bf-b98c-ff7108f5185d", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:24.256Z", "updated_at": "2026-09-26T18:42:25.191Z" }, "description_available": false, "entity_type": "Url", "id": "2f0b246d-9da2-41d0-9952-b629e5c19d5d", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "url--556bbbc0-bd24-5a7a-8832-fa553f614722", "type": "Url" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:13.980Z", "updated_at": "2026-09-26T18:42:37.213Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "32d5e59b-3ce8-4e53-94ad-f464dac9e86e", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--f6c640ec-08de-5a35-9030-f8deb4ffa909", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.529Z", "created_at": "2026-09-26T18:42:34.531Z", "modified": "2026-09-26T18:43:38.516Z", "updated_at": "2026-09-26T18:43:38.516Z" }, "description_available": false, "entity_type": "Indicator", "id": "3b3406ec-b471-4d40-bbf4-c24aa0c210eb", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--fbdaa5aa-72b8-592b-bc44-e71e26076282", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:10.957Z", "updated_at": "2026-09-26T18:42:11.177Z" }, "description_available": false, "entity_type": "Hostname", "id": "3dd7f9f3-9e27-4d63-a004-16d606a8abd4", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--4c18085d-46ad-55ac-a412-f9b77f25440d", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.610Z", "created_at": "2026-09-26T18:42:58.885Z", "modified": "2026-09-26T18:45:59.748Z", "updated_at": "2026-09-26T18:45:59.748Z" }, "description_available": false, "entity_type": "Indicator", "id": "43e041db-b4d3-40e0-b1f4-7cf0ca561a1f", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--e8bb0261-f99e-584d-ae7c-3c2f1719f515", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:16.208Z", "updated_at": "2026-09-26T18:42:47.387Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "47ce2fad-9ad4-4a0c-8668-a682503d9bed", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--e36ab1c5-2c8a-564e-aaca-7bd155eff623", "type": "IPv4Addr" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:03.276Z", "updated_at": "2026-09-26T18:42:04.174Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "4951d272-b8df-41e8-bb01-a9bf50355f4b", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--d0ebbf83-95d8-51f7-b933-b88152dc7640", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:07.045Z", "updated_at": "2026-09-26T18:42:09.074Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "4b51069c-f3bd-458a-9d91-efa979cc9ef7", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--4c37c7eb-6d36-5919-8516-d10787c27683", "type": "DomainName" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:12.351Z", "updated_at": "2026-09-26T18:42:35.250Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "4c3d0e8f-8e6d-4ac1-a944-932af9e665ba", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--7a1d0f1b-8be2-5712-b54c-2f669fa6e493", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.604Z", "created_at": "2026-09-26T18:42:57.096Z", "modified": "2026-09-26T18:45:53.450Z", "updated_at": "2026-09-26T18:45:53.450Z" }, "description_available": false, "entity_type": "Indicator", "id": "51141c7c-7edc-4469-b255-fed2a1070598", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--0c68cb5d-64f4-5ad3-aa14-c449d4edac22", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:20.479Z", "updated_at": "2026-09-26T18:43:10.952Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "53715754-4c32-41a6-8c62-ae9538ecd149", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--309ce5f4-0e38-519e-b68e-d71cb928e3f5", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.520Z", "created_at": "2026-09-26T18:42:30.489Z", "modified": "2026-09-26T18:43:30.309Z", "updated_at": "2026-09-26T18:43:30.309Z" }, "description_available": false, "entity_type": "Indicator", "id": "55304e62-0d32-40a6-bb46-517081a6ea47", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--d69fcb30-9019-5280-a29a-34d534a25201", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:05.461Z", "updated_at": "2026-09-26T18:42:06.054Z" }, "description_available": false, "entity_type": "Hostname", "id": "5c4bc20a-7602-42e7-b09d-0078db3b5f54", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--b2fbe067-8b58-5ec4-8619-fc5d54b95257", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.524Z", "created_at": "2026-09-26T18:42:33.644Z", "modified": "2026-09-26T18:43:32.993Z", "updated_at": "2026-09-26T18:43:32.993Z" }, "description_available": false, "entity_type": "Indicator", "id": "5e4a5c6a-c170-46b8-8af4-72df3f4893f8", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--a5314d47-3afc-5a00-88d1-a97faea55856", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:59.930Z", "updated_at": "2026-09-26T18:42:00.229Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "62240b4b-4a55-45bd-aabc-8c67cb2e79dc", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--e349f91f-f5ac-568b-b277-1b867eb8c379", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:07.539Z", "updated_at": "2026-09-26T18:42:09.688Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "654d0bf9-05af-493f-8190-9d9a916fe0e7", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--40ee65fd-783f-5cf7-b3b3-983d2eacb22f", "type": "DomainName" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:55.943Z", "updated_at": "2026-09-26T18:42:16.968Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "6684ef8a-4abc-4ae0-bea0-f10ac3aa1cc4", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--b314a8a0-24eb-5bba-b97e-55a67ee2ddf4", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:24.160Z", "updated_at": "2026-09-26T18:43:15.140Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "69e73cea-d1c7-46d1-96bf-aaf68b151d64", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--3928e969-d294-5bf9-a639-a2d772b37dee", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.590Z", "created_at": "2026-09-26T18:42:51.561Z", "modified": "2026-09-26T18:45:43.483Z", "updated_at": "2026-09-26T18:45:43.483Z" }, "description_available": false, "entity_type": "Indicator", "id": "6d77369b-a19a-409a-a628-25a848739119", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--5256b995-07b8-5ab5-88fd-400c33c01462", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:24.412Z", "updated_at": "2026-09-26T18:42:27.613Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "6d84e1dc-3412-4b5b-b2c2-1215bd5da7ab", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--2a63c070-f5a5-56f3-acea-0504a8728488", "type": "DomainName" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:17.892Z", "updated_at": "2026-09-26T18:42:52.827Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "72ea39ba-bc7f-461f-b17e-c698b6ddda6a", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--52366ae7-b156-55f0-afe2-f82c35e3fe8e", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:56.468Z", "updated_at": "2026-09-26T18:42:19.373Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "746f8e45-268a-4aa2-b77e-299c20bd35ea", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--bff0c076-bfc4-552f-8ef4-62c5b381788e", "type": "IPv4Addr" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:00.129Z", "updated_at": "2026-09-26T18:42:00.666Z" }, "description_available": false, "entity_type": "StixFile", "id": "756361ab-2069-443d-b79d-68480a0c88ef", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "file--cb0dcc5c-4fde-5fc9-be7b-ee3878dddbe1", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.548Z", "created_at": "2026-09-26T18:42:41.512Z", "modified": "2026-09-26T18:44:45.314Z", "updated_at": "2026-09-26T18:44:45.314Z" }, "description_available": false, "entity_type": "Indicator", "id": "7631ad2e-7f90-4a21-93f6-27ed88580692", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--360bec26-572b-5646-b997-090259f2275a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.574Z", "created_at": "2026-09-26T18:42:46.846Z", "modified": "2026-09-26T18:45:24.171Z", "updated_at": "2026-09-26T18:45:24.171Z" }, "description_available": false, "entity_type": "Indicator", "id": "769ce956-6545-4f02-a734-472df18c6603", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--aa71711b-9297-5dd8-8261-1e0fcc0efdd4", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:18.633Z", "updated_at": "2026-09-26T18:42:58.310Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "7bbf0609-96fa-4ec3-be4a-4b20e739f999", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--82f7efe3-7404-5c96-9e40-e676c010e9f9", "type": "IPv4Addr" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:10.756Z", "updated_at": "2026-09-26T18:42:10.989Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "7bda89d7-25a2-43de-9e2e-a5e74570c27c", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--a08731f7-dc95-5a30-afb3-1fd235628bf6", "type": "DomainName" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:46.831Z", "updated_at": "2026-09-26T18:41:47.288Z" }, "description_available": false, "entity_type": "Hostname", "id": "7ee905a1-48b6-4e91-9bb7-e42418e609ab", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--acdf0b1e-4541-53e3-bfff-ef44e69351bc", "type": "Hostname" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:50.424Z", "updated_at": "2026-09-26T18:43:10.495Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "83917fff-07d8-4007-ab68-dec0f5d4e236", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--16cff57d-b071-5957-ad11-386ffb7485f7", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.543Z", "created_at": "2026-09-26T18:42:40.113Z", "modified": "2026-09-26T18:43:53.631Z", "updated_at": "2026-09-26T18:43:53.631Z" }, "description_available": false, "entity_type": "Indicator", "id": "886e8cc5-77b9-4999-81e2-04970d3b4214", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--de5912e1-de81-5945-a35e-44ac89220e78", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.599Z", "created_at": "2026-09-26T18:42:56.077Z", "modified": "2026-09-26T18:45:50.181Z", "updated_at": "2026-09-26T18:45:50.181Z" }, "description_available": false, "entity_type": "Indicator", "id": "89fdda86-d751-4df2-8e66-a948f8d50bd0", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--886f4232-fd07-5910-8de4-01574f68a134", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:12.175Z", "updated_at": "2026-09-26T18:42:29.435Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "94f66d0d-6f90-46ee-98e5-f1f1777d11bb", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--31f49925-e8f1-538f-9463-2d8896639e09", "type": "IPv4Addr" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:05.035Z", "updated_at": "2026-09-26T18:42:05.743Z" }, "description_available": false, "entity_type": "Hostname", "id": "95feb8d5-3485-44a9-8d4b-55bfb35a8e57", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--cff444b1-5090-5e8b-b405-67e3262e80c8", "type": "Hostname" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:11.020Z", "updated_at": "2026-09-26T18:42:25.926Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "98b50b44-f0af-49ee-8feb-7eec4177f14d", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--7685dbb9-5bde-5b6e-bb76-b8002af5094c", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:53.455Z", "updated_at": "2026-09-26T18:42:06.970Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "9c723dda-b8ec-47ca-b79a-ad79b8188add", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--f4657aa3-682f-5e08-9922-5d0316b46403", "type": "IPv4Addr" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:46.760Z", "updated_at": "2026-09-26T18:41:47.142Z" }, "description_available": false, "entity_type": "Hostname", "id": "9dd43c9e-7de8-40ab-b8ff-ebaa96cde046", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--7e87fc2c-eca6-5fb8-a31c-73e5a09957cd", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.576Z", "created_at": "2026-09-26T18:42:48.090Z", "modified": "2026-09-26T18:45:29.237Z", "updated_at": "2026-09-26T18:45:29.237Z" }, "description_available": false, "entity_type": "Indicator", "id": "9f115f55-6dee-4ece-bba3-d4ba3bb4bd8f", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--d14bd159-4426-5820-96e3-e0b11eda08e2", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:17.891Z", "updated_at": "2026-09-26T18:42:56.542Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "a039cf35-bf94-4e26-a0a7-7dbb9d30289a", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--e0d26b6a-0f6f-5c18-92a2-095afa2c3179", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.624Z", "created_at": "2026-09-26T18:43:06.681Z", "modified": "2026-09-26T18:46:11.516Z", "updated_at": "2026-09-26T18:46:11.516Z" }, "description_available": false, "entity_type": "Indicator", "id": "a0ebc941-df6a-44f4-8493-c4d553a76f71", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--eb725562-1c96-50fc-874b-5cc44d360b0e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.539Z", "created_at": "2026-09-26T18:42:37.160Z", "modified": "2026-09-26T18:43:49.628Z", "updated_at": "2026-09-26T18:43:49.628Z" }, "description_available": false, "entity_type": "Indicator", "id": "a161e7d1-56aa-420e-86bf-dc511445c215", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--5bf7fdf0-b5ad-59a4-a748-17781374b8e3", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.608Z", "created_at": "2026-09-26T18:42:57.937Z", "modified": "2026-09-26T18:45:57.442Z", "updated_at": "2026-09-26T18:45:57.442Z" }, "description_available": false, "entity_type": "Indicator", "id": "a7b5d72d-d496-4080-b4d2-587df0ef294e", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--0532bc97-9664-5291-82cb-cf73d23e1991", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:46.856Z", "updated_at": "2026-09-26T18:41:47.287Z" }, "description_available": false, "entity_type": "Hostname", "id": "a8d048a9-e0f5-48be-9dc6-bc1fcca43009", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--1cdb5a48-9c83-50d7-b4d1-eaa1232b0ffd", "type": "Hostname" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:50.425Z", "updated_at": "2026-09-26T18:41:59.094Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "acd289b3-8ede-4c9c-87d1-7acea9a90c9e", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--4cb46df0-98e5-5aa9-9139-390f2efd6d73", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.581Z", "created_at": "2026-09-26T18:42:48.800Z", "modified": "2026-09-26T18:45:34.322Z", "updated_at": "2026-09-26T18:45:34.322Z" }, "description_available": false, "entity_type": "Indicator", "id": "ad5a4ebc-0787-426b-88a6-1c70eb8d2b9a", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--f356f9c4-3b2f-5851-9757-903bd5c9ba3c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.583Z", "created_at": "2026-09-26T18:42:49.765Z", "modified": "2026-09-26T18:45:35.213Z", "updated_at": "2026-09-26T18:45:35.213Z" }, "description_available": false, "entity_type": "Indicator", "id": "b25d7245-dc30-4b3d-b09a-c45093069e64", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--c92dec22-ac6e-5a7d-93de-93e844ae08b4", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.569Z", "created_at": "2026-09-26T18:42:46.847Z", "modified": "2026-09-26T18:45:27.046Z", "updated_at": "2026-09-26T18:45:27.046Z" }, "description_available": false, "entity_type": "Indicator", "id": "b3963eed-b419-4b4f-8211-7654094add34", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--e6bbb8ff-a5fe-5060-978c-ea4741b4614e", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:19.656Z", "updated_at": "2026-09-26T18:43:07.664Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "b6e0ef55-e4d6-456d-8286-5140be6c35e6", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--8273a1c0-7c3a-50c0-9a93-7cb8a9c4b55f", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.560Z", "created_at": "2026-09-26T18:42:44.045Z", "modified": "2026-09-26T18:45:12.853Z", "updated_at": "2026-09-26T18:45:12.853Z" }, "description_available": false, "entity_type": "Indicator", "id": "b8c3120e-9125-4a1b-a6f1-4285008161c0", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--82596e3a-0323-5049-bdb0-32cba4da001d", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:54.653Z", "updated_at": "2026-09-26T18:42:13.696Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "ba8128ff-cee1-4139-a71a-15e3fbc04aca", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--aed688c5-c884-5670-b58d-03b72dcc27aa", "type": "IPv4Addr" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:05.465Z", "updated_at": "2026-09-26T18:42:06.106Z" }, "description_available": false, "entity_type": "Hostname", "id": "c32ef5d8-1d34-4b33-adfc-075fa1f9ccfa", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--c874048f-c8db-5a05-a380-7454f0bd86f5", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.592Z", "created_at": "2026-09-26T18:42:52.364Z", "modified": "2026-09-26T18:45:44.944Z", "updated_at": "2026-09-26T18:45:44.944Z" }, "description_available": false, "entity_type": "Indicator", "id": "c4e3a6bc-86de-497f-aa36-e8989ca73eef", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--f11c05a7-c819-5e6d-a5ff-61d69e03c93b", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:26.156Z", "updated_at": "2026-09-26T18:42:27.866Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "c4f2aab9-c3ce-4ccf-a438-8ccac46938d0", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--fef61349-7e11-5ec3-89de-70663b14fdf6", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.550Z", "created_at": "2026-09-26T18:42:41.686Z", "modified": "2026-09-26T18:45:00.718Z", "updated_at": "2026-09-26T18:45:00.718Z" }, "description_available": false, "entity_type": "Indicator", "id": "c5151b3b-c305-49f4-8682-b4d0b2781ce5", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--5b77339f-3111-523c-991a-f7234b51b135", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.613Z", "created_at": "2026-09-26T18:42:59.813Z", "modified": "2026-09-26T18:46:00.509Z", "updated_at": "2026-09-26T18:46:00.509Z" }, "description_available": false, "entity_type": "Indicator", "id": "c5223aa8-6c94-47f4-a4e5-e8482e6a6438", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--ca88f463-0a29-5191-a6dd-0df633c5f742", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.578Z", "created_at": "2026-09-26T18:42:48.789Z", "modified": "2026-09-26T18:45:32.234Z", "updated_at": "2026-09-26T18:45:32.234Z" }, "description_available": false, "entity_type": "Indicator", "id": "c5c25bc9-0ca2-4078-b7c9-d18c422c79f7", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--a25fbfe2-3975-5bde-b1be-94b1ccf9e1b5", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:48.604Z", "updated_at": "2026-09-26T18:41:54.287Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "c6f1376b-95eb-4a15-9152-cf3e23fca79a", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--1fd7bfae-3298-5ebf-9661-ff061884c6ed", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.536Z", "created_at": "2026-09-26T18:42:36.390Z", "modified": "2026-09-26T18:43:45.965Z", "updated_at": "2026-09-26T18:43:45.965Z" }, "description_available": false, "entity_type": "Indicator", "id": "cc305fda-d098-47b8-a073-a8d97a815a03", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--b555f29e-00f6-5865-b445-0c68278d1b8a", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:03.108Z", "updated_at": "2026-09-26T18:42:03.860Z" }, "description_available": false, "entity_type": "Hostname", "id": "ceb93118-4b19-4d1d-b423-40f239480c28", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--a1b23a5d-77d8-561f-bab5-418e31f15379", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:00.128Z", "updated_at": "2026-09-26T18:42:00.583Z" }, "description_available": false, "entity_type": "StixFile", "id": "cee7f66a-839e-4b79-8dd1-b76d20c70f1f", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "file--06b7f166-fe43-5bef-9780-ff089077ad25", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.527Z", "created_at": "2026-09-26T18:42:33.955Z", "modified": "2026-09-26T18:43:35.902Z", "updated_at": "2026-09-26T18:43:35.902Z" }, "description_available": false, "entity_type": "Indicator", "id": "d138989a-51b7-4c8d-ab3e-b76feb544dbe", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--1feb5760-6664-5000-bafb-3207965158ac", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:03.111Z", "updated_at": "2026-09-26T18:42:04.172Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "d6a726e2-abc5-4e0e-9ede-5f9f40de6c00", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "domain-name--0594d88a-662a-5ae9-88cf-ffd46dc7452f", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.532Z", "created_at": "2026-09-26T18:42:35.597Z", "modified": "2026-09-26T18:43:41.027Z", "updated_at": "2026-09-26T18:43:41.027Z" }, "description_available": false, "entity_type": "Indicator", "id": "d713410d-ce98-4542-baa7-c80e216ba030", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--93c009df-45c4-5ec7-8257-77e8a7b97b91", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:16.834Z", "updated_at": "2026-09-26T18:42:49.893Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "d9158aab-ecea-43ff-a56f-eb2ced467425", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--1271c613-7c5f-53e3-a96f-eb8ecef507b4", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.558Z", "created_at": "2026-09-26T18:42:43.126Z", "modified": "2026-09-26T18:45:07.794Z", "updated_at": "2026-09-26T18:45:07.794Z" }, "description_available": false, "entity_type": "Indicator", "id": "da8decea-4150-4b5e-9f18-7c1560ae3266", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--ff7223b9-7e0e-583b-b588-1edc4511e559", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:42:07.141Z", "updated_at": "2026-09-26T18:42:09.361Z" }, "description_available": false, "entity_type": "Hostname", "id": "ddb516ec-80f4-435a-bf24-e7ea5f6ef03b", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--cea941b8-7834-55ad-b7bb-f42f2a9ca2de", "type": "Hostname" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:55.967Z", "updated_at": "2026-09-26T18:41:58.353Z" }, "description_available": false, "entity_type": "Hostname", "id": "e256fe8a-5bd0-4f3a-92fc-5676df1904e8", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "hostname--6898544e-ab51-53c9-9981-85879796ccf2", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.622Z", "created_at": "2026-09-26T18:43:06.676Z", "modified": "2026-09-26T18:46:10.293Z", "updated_at": "2026-09-26T18:46:10.293Z" }, "description_available": false, "entity_type": "Indicator", "id": "e56ddefd-95c0-4e5e-a8a1-b66f1b505c67", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--0440edbe-c4d6-5da6-915d-b458f06572e5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.620Z", "created_at": "2026-09-26T18:43:04.375Z", "modified": "2026-09-26T18:46:07.585Z", "updated_at": "2026-09-26T18:46:07.585Z" }, "description_available": false, "entity_type": "Indicator", "id": "e772aab5-2b33-4d12-abb8-bef9e84d0171", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--4bbbaab0-24ce-5032-ba2a-228a1569f9ee", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.595Z", "created_at": "2026-09-26T18:42:52.504Z", "modified": "2026-09-26T18:45:46.234Z", "updated_at": "2026-09-26T18:45:46.234Z" }, "description_available": false, "entity_type": "Indicator", "id": "e84301b7-ea53-4e57-a8ed-4741e281b4cf", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--3e9ed6b5-1071-5f43-a5e6-887dbe3d536c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.597Z", "created_at": "2026-09-26T18:42:53.063Z", "modified": "2026-09-26T18:45:48.376Z", "updated_at": "2026-09-26T18:45:48.376Z" }, "description_available": false, "entity_type": "Indicator", "id": "e93adba4-2072-45b5-8ed8-8ef669c825a3", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--662ea8f3-c897-50bb-a4a4-40d32b121af9", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.541Z", "created_at": "2026-09-26T18:42:40.114Z", "modified": "2026-09-26T18:44:04.419Z", "updated_at": "2026-09-26T18:44:04.419Z" }, "description_available": false, "entity_type": "Indicator", "id": "e9a275d3-a10c-4c7e-8110-bb6be69319ae", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--72a2aff5-ac73-5c5b-a691-6435ce42df2f", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:41:53.466Z", "updated_at": "2026-09-26T18:42:11.555Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "ea733a3d-3a24-45a5-8d43-7aae269c2646", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "ipv4-addr--d85d7502-8b8f-5069-a2d5-4b94d0c9730d", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.534Z", "created_at": "2026-09-26T18:42:36.156Z", "modified": "2026-09-26T18:43:43.998Z", "updated_at": "2026-09-26T18:43:43.998Z" }, "description_available": false, "entity_type": "Indicator", "id": "f6d26ded-abc9-4b75-834d-e00260ae5448", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--db2d7116-9f0c-5808-9c22-7995243a918f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.585Z", "created_at": "2026-09-26T18:42:50.944Z", "modified": "2026-09-26T18:45:40.221Z", "updated_at": "2026-09-26T18:45:40.221Z" }, "description_available": false, "entity_type": "Indicator", "id": "f9820915-a9a2-4069-9949-f7e13a8678fb", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--a6159b00-7e1a-5059-a2d1-35561ba679f1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.572Z", "created_at": "2026-09-26T18:42:46.853Z", "modified": "2026-09-26T18:45:25.963Z", "updated_at": "2026-09-26T18:45:25.963Z" }, "description_available": false, "entity_type": "Indicator", "id": "fea2f7ff-e1ea-4b05-b39b-10944aa093cc", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "indicator--df3e4dbd-b0d8-5e29-ad78-d7c4137d76a0", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.609Z", "created_at": "2026-09-26T18:43:34.180Z", "modified": "2026-09-26T18:43:34.806Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:34.806Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a7b5d72d-d496-4080-b4d2-587df0ef294e", "from_id": "a7b5d72d-d496-4080-b4d2-587df0ef294e", "from_name": null, "from_type": "Indicator", "id": "047aa383-25ba-4e0e-9b25-346505992791", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--2e08b8da-0d29-5b92-a0cd-48f49955cb92", "toId": "7bbf0609-96fa-4ec3-be4a-4b20e739f999", "to_id": "7bbf0609-96fa-4ec3-be4a-4b20e739f999", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.598Z", "created_at": "2026-09-26T18:43:31.263Z", "modified": "2026-09-26T18:43:31.816Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:31.816Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e93adba4-2072-45b5-8ed8-8ef669c825a3", "from_id": "e93adba4-2072-45b5-8ed8-8ef669c825a3", "from_name": null, "from_type": "Indicator", "id": "12dbc5a8-134b-4b7d-a683-08b802a36c3a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--956c746f-bae5-57ab-abac-5c0dfdf23cee", "toId": "06be6b34-b31e-4db1-a003-42e1c119ee0c", "to_id": "06be6b34-b31e-4db1-a003-42e1c119ee0c", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.571Z", "created_at": "2026-09-26T18:43:19.964Z", "modified": "2026-09-26T18:43:20.399Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:20.399Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b3963eed-b419-4b4f-8211-7654094add34", "from_id": "b3963eed-b419-4b4f-8211-7654094add34", "from_name": null, "from_type": "Indicator", "id": "15cd99aa-b144-42ac-8bb4-2113439dea6b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--d5c8cdd5-013e-54f3-a280-e919b0bd3d08", "toId": "4b51069c-f3bd-458a-9d91-efa979cc9ef7", "to_id": "4b51069c-f3bd-458a-9d91-efa979cc9ef7", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.596Z", "created_at": "2026-09-26T18:43:27.736Z", "modified": "2026-09-26T18:43:31.714Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:31.714Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e84301b7-ea53-4e57-a8ed-4741e281b4cf", "from_id": "e84301b7-ea53-4e57-a8ed-4741e281b4cf", "from_name": null, "from_type": "Indicator", "id": "183c55f4-f4c0-4bed-9e8d-5ee4bfaa4c5c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--7a6d4820-3a40-51b0-aab9-8793112cc63c", "toId": "1e9123c6-5ea9-41fa-a344-92cc30d52ff1", "to_id": "1e9123c6-5ea9-41fa-a344-92cc30d52ff1", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.568Z", "created_at": "2026-09-26T18:43:19.652Z", "modified": "2026-09-26T18:43:20.190Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:20.190Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1a7c9ffb-fb7f-49bd-9057-ad42837beb18", "from_id": "1a7c9ffb-fb7f-49bd-9057-ad42837beb18", "from_name": null, "from_type": "Indicator", "id": "231b4382-94aa-465c-9211-e7922ea056fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--c36b80af-bfe8-5b29-ae33-1471cc85f892", "toId": "5c4bc20a-7602-42e7-b09d-0078db3b5f54", "to_id": "5c4bc20a-7602-42e7-b09d-0078db3b5f54", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.557Z", "created_at": "2026-09-26T18:43:17.131Z", "modified": "2026-09-26T18:43:17.658Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:17.658Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0e880342-2986-446f-b3e8-f1f7b48b44a7", "from_id": "0e880342-2986-446f-b3e8-f1f7b48b44a7", "from_name": null, "from_type": "Indicator", "id": "27c54639-3912-4aab-b028-80d9776d292e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--64ce8a67-53ad-5752-b377-b48ba1953491", "toId": "ceb93118-4b19-4d1d-b423-40f239480c28", "to_id": "ceb93118-4b19-4d1d-b423-40f239480c28", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.515Z", "created_at": "2026-09-26T18:43:07.852Z", "modified": "2026-09-26T18:43:08.328Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:08.328Z" }, "description_available": false, "entity_type": "based-on", "fromId": "199c5276-8916-46fa-bcc8-b4b293473165", "from_id": "199c5276-8916-46fa-bcc8-b4b293473165", "from_name": null, "from_type": "Indicator", "id": "2e9c0e72-5e1d-4fe5-8fae-2da92c1fd3a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--1b48ae4f-14f5-5588-943f-f5e0d6f6c9c2", "toId": "a8d048a9-e0f5-48be-9dc6-bc1fcca43009", "to_id": "a8d048a9-e0f5-48be-9dc6-bc1fcca43009", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.535Z", "created_at": "2026-09-26T18:43:13.290Z", "modified": "2026-09-26T18:43:14.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:14.101Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f6d26ded-abc9-4b75-834d-e00260ae5448", "from_id": "f6d26ded-abc9-4b75-834d-e00260ae5448", "from_name": null, "from_type": "Indicator", "id": "304afeda-bc82-4bee-a261-46a8576ad99b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--12be4f5f-c660-54ce-a070-2c41724c835f", "toId": "ea733a3d-3a24-45a5-8d43-7aae269c2646", "to_id": "ea733a3d-3a24-45a5-8d43-7aae269c2646", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.616Z", "created_at": "2026-09-26T18:43:35.958Z", "modified": "2026-09-26T18:43:36.584Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:36.584Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2cce5a19-792d-4f64-9d8e-6f83e12b9005", "from_id": "2cce5a19-792d-4f64-9d8e-6f83e12b9005", "from_name": null, "from_type": "Indicator", "id": "3e16bf93-38d0-44a8-a74e-926b8b45e691", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--e6a55809-0ced-5cef-b085-36c98262c294", "toId": "53715754-4c32-41a6-8c62-ae9538ecd149", "to_id": "53715754-4c32-41a6-8c62-ae9538ecd149", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.594Z", "created_at": "2026-09-26T18:43:25.657Z", "modified": "2026-09-26T18:43:30.594Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:30.594Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c4e3a6bc-86de-497f-aa36-e8989ca73eef", "from_id": "c4e3a6bc-86de-497f-aa36-e8989ca73eef", "from_name": null, "from_type": "Indicator", "id": "447df999-38de-4a70-b316-e0e6c56382c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--5479fcdc-41a4-5875-9b3d-0325654db7e8", "toId": "32d5e59b-3ce8-4e53-94ad-f464dac9e86e", "to_id": "32d5e59b-3ce8-4e53-94ad-f464dac9e86e", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.612Z", "created_at": "2026-09-26T18:43:34.484Z", "modified": "2026-09-26T18:43:35.325Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:35.325Z" }, "description_available": false, "entity_type": "based-on", "fromId": "43e041db-b4d3-40e0-b1f4-7cf0ca561a1f", "from_id": "43e041db-b4d3-40e0-b1f4-7cf0ca561a1f", "from_name": null, "from_type": "Indicator", "id": "4734ec82-6570-4ebd-84be-d1b7c44f47ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--dd1f9523-0dea-5503-ba23-b69cbd387046", "toId": "b6e0ef55-e4d6-456d-8286-5140be6c35e6", "to_id": "b6e0ef55-e4d6-456d-8286-5140be6c35e6", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.549Z", "created_at": "2026-09-26T18:43:16.158Z", "modified": "2026-09-26T18:43:16.477Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:16.477Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7631ad2e-7f90-4a21-93f6-27ed88580692", "from_id": "7631ad2e-7f90-4a21-93f6-27ed88580692", "from_name": null, "from_type": "Indicator", "id": "5287dea2-f917-4bb1-9a05-dddaf5904e78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--70252cc3-ed73-5c58-831a-dc968dbc9370", "toId": "62240b4b-4a55-45bd-aabc-8c67cb2e79dc", "to_id": "62240b4b-4a55-45bd-aabc-8c67cb2e79dc", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.528Z", "created_at": "2026-09-26T18:43:12.827Z", "modified": "2026-09-26T18:43:13.226Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:13.226Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d138989a-51b7-4c8d-ab3e-b76feb544dbe", "from_id": "d138989a-51b7-4c8d-ab3e-b76feb544dbe", "from_name": null, "from_type": "Indicator", "id": "5754ccb6-73ba-4fe0-a532-8afd58b9e0d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--e0e5d6ad-f102-5972-9633-9072635b3fcc", "toId": "83917fff-07d8-4007-ab68-dec0f5d4e236", "to_id": "83917fff-07d8-4007-ab68-dec0f5d4e236", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.544Z", "created_at": "2026-09-26T18:43:15.199Z", "modified": "2026-09-26T18:43:15.624Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:15.624Z" }, "description_available": false, "entity_type": "based-on", "fromId": "886e8cc5-77b9-4999-81e2-04970d3b4214", "from_id": "886e8cc5-77b9-4999-81e2-04970d3b4214", "from_name": null, "from_type": "Indicator", "id": "58018b6e-f40c-45b5-8bdc-382fc230596e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--081630ea-8764-58de-a29c-4f6b82c8385c", "toId": "e256fe8a-5bd0-4f3a-92fc-5676df1904e8", "to_id": "e256fe8a-5bd0-4f3a-92fc-5676df1904e8", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.566Z", "created_at": "2026-09-26T18:43:19.116Z", "modified": "2026-09-26T18:43:19.588Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:19.588Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0e828aed-7ade-4781-ab41-6ebcb49ea6cc", "from_id": "0e828aed-7ade-4781-ab41-6ebcb49ea6cc", "from_name": null, "from_type": "Indicator", "id": "61e45585-8a1a-4bf6-be96-4a3de80c5c0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--b138589c-25c8-558d-a957-b450c3ac6bef", "toId": "c32ef5d8-1d34-4b33-adfc-075fa1f9ccfa", "to_id": "c32ef5d8-1d34-4b33-adfc-075fa1f9ccfa", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.584Z", "created_at": "2026-09-26T18:43:24.337Z", "modified": "2026-09-26T18:43:24.711Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:24.711Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b25d7245-dc30-4b3d-b09a-c45093069e64", "from_id": "b25d7245-dc30-4b3d-b09a-c45093069e64", "from_name": null, "from_type": "Indicator", "id": "620fe1ba-792e-468b-8271-bf402cc97c9b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--3734180e-1e2c-5546-9ed1-0da7801ed6ea", "toId": "94f66d0d-6f90-46ee-98e5-f1f1777d11bb", "to_id": "94f66d0d-6f90-46ee-98e5-f1f1777d11bb", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.623Z", "created_at": "2026-09-26T18:43:37.598Z", "modified": "2026-09-26T18:43:38.190Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:38.190Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e56ddefd-95c0-4e5e-a8a1-b66f1b505c67", "from_id": "e56ddefd-95c0-4e5e-a8a1-b66f1b505c67", "from_name": null, "from_type": "Indicator", "id": "6c8a5d68-6917-450f-8eaf-5e59dbc877e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--74d34f41-b175-5367-ac5c-e218bc8f0181", "toId": "6d84e1dc-3412-4b5b-b2c2-1215bd5da7ab", "to_id": "6d84e1dc-3412-4b5b-b2c2-1215bd5da7ab", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.519Z", "created_at": "2026-09-26T18:43:09.253Z", "modified": "2026-09-26T18:43:09.599Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:09.599Z" }, "description_available": false, "entity_type": "based-on", "fromId": "28f920f3-2ed6-418c-b0fe-6693bbab376b", "from_id": "28f920f3-2ed6-418c-b0fe-6693bbab376b", "from_name": null, "from_type": "Indicator", "id": "70f6bad5-f335-47d1-971e-170a0deb33e5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--e7293ba7-f98b-5d29-8fd9-c410d991bc45", "toId": "9dd43c9e-7de8-40ab-b8ff-ebaa96cde046", "to_id": "9dd43c9e-7de8-40ab-b8ff-ebaa96cde046", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.538Z", "created_at": "2026-09-26T18:43:13.774Z", "modified": "2026-09-26T18:43:14.545Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:14.545Z" }, "description_available": false, "entity_type": "based-on", "fromId": "cc305fda-d098-47b8-a073-a8d97a815a03", "from_id": "cc305fda-d098-47b8-a073-a8d97a815a03", "from_name": null, "from_type": "Indicator", "id": "72eded95-225f-4388-a1c8-8b97f36954d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--8fa86f80-ac36-5220-8a1a-0afe85e77910", "toId": "9c723dda-b8ec-47ca-b79a-ad79b8188add", "to_id": "9c723dda-b8ec-47ca-b79a-ad79b8188add", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.621Z", "created_at": "2026-09-26T18:43:36.387Z", "modified": "2026-09-26T18:43:37.250Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:37.250Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e772aab5-2b33-4d12-abb8-bef9e84d0171", "from_id": "e772aab5-2b33-4d12-abb8-bef9e84d0171", "from_name": null, "from_type": "Indicator", "id": "77678228-386f-4823-8615-de82018e1321", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--8e8b3681-9218-5e81-b98f-9f92d616b380", "toId": "2f0b246d-9da2-41d0-9952-b629e5c19d5d", "to_id": "2f0b246d-9da2-41d0-9952-b629e5c19d5d", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.580Z", "created_at": "2026-09-26T18:43:21.299Z", "modified": "2026-09-26T18:43:24.038Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:24.038Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c5c25bc9-0ca2-4078-b7c9-d18c422c79f7", "from_id": "c5c25bc9-0ca2-4078-b7c9-d18c422c79f7", "from_name": null, "from_type": "Indicator", "id": "793e5d15-4b45-419f-9b43-34be8fd49336", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--5497cb0f-2ac7-5795-b62f-35d817f4fc8d", "toId": "3dd7f9f3-9e27-4d63-a004-16d606a8abd4", "to_id": "3dd7f9f3-9e27-4d63-a004-16d606a8abd4", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.522Z", "created_at": "2026-09-26T18:43:09.402Z", "modified": "2026-09-26T18:43:10.147Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:10.147Z" }, "description_available": false, "entity_type": "based-on", "fromId": "55304e62-0d32-40a6-bb46-517081a6ea47", "from_id": "55304e62-0d32-40a6-bb46-517081a6ea47", "from_name": null, "from_type": "Indicator", "id": "802cbf15-527c-414c-b2d5-d3a84985b82a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--270e0b0e-86ed-5e23-a67b-4b74e3160b8f", "toId": "7ee905a1-48b6-4e91-9bb7-e42418e609ab", "to_id": "7ee905a1-48b6-4e91-9bb7-e42418e609ab", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.554Z", "created_at": "2026-09-26T18:43:16.620Z", "modified": "2026-09-26T18:43:17.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:17.335Z" }, "description_available": false, "entity_type": "based-on", "fromId": "02c3a6b9-b500-44d2-b446-56e7879959d3", "from_id": "02c3a6b9-b500-44d2-b446-56e7879959d3", "from_name": null, "from_type": "Indicator", "id": "83636167-9d4e-4d3d-be5a-fd2a0e7b955d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--7a55f067-456c-5865-973b-8619bb9b2f6a", "toId": "cee7f66a-839e-4b79-8dd1-b76d20c70f1f", "to_id": "cee7f66a-839e-4b79-8dd1-b76d20c70f1f", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.591Z", "created_at": "2026-09-26T18:43:25.303Z", "modified": "2026-09-26T18:43:30.592Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:30.592Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6d77369b-a19a-409a-a628-25a848739119", "from_id": "6d77369b-a19a-409a-a628-25a848739119", "from_name": null, "from_type": "Indicator", "id": "85b6d928-3aba-4fcb-a427-60c3771ffdcc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--32dd6d07-2b84-5835-975a-37863540c8f7", "toId": "00523697-93d4-4bf5-b700-2d3a09c909d9", "to_id": "00523697-93d4-4bf5-b700-2d3a09c909d9", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.600Z", "created_at": "2026-09-26T18:43:31.320Z", "modified": "2026-09-26T18:43:31.818Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:31.818Z" }, "description_available": false, "entity_type": "based-on", "fromId": "89fdda86-d751-4df2-8e66-a948f8d50bd0", "from_id": "89fdda86-d751-4df2-8e66-a948f8d50bd0", "from_name": null, "from_type": "Indicator", "id": "8bd95912-6cfb-4f34-82d7-ff9410cfa504", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--0c12686e-bd62-5e71-95e6-9991563f126c", "toId": "47ce2fad-9ad4-4a0c-8668-a682503d9bed", "to_id": "47ce2fad-9ad4-4a0c-8668-a682503d9bed", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.547Z", "created_at": "2026-09-26T18:43:15.473Z", "modified": "2026-09-26T18:43:15.867Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:15.867Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1ed853ad-9369-4364-a8af-b554b9567871", "from_id": "1ed853ad-9369-4364-a8af-b554b9567871", "from_name": null, "from_type": "Indicator", "id": "8d42bfd1-823b-453c-abfb-c44667633a35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--20e58333-fb65-54fd-a675-a45cab0f575e", "toId": "746f8e45-268a-4aa2-b77e-299c20bd35ea", "to_id": "746f8e45-268a-4aa2-b77e-299c20bd35ea", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.575Z", "created_at": "2026-09-26T18:43:20.709Z", "modified": "2026-09-26T18:43:21.205Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:21.205Z" }, "description_available": false, "entity_type": "based-on", "fromId": "769ce956-6545-4f02-a734-472df18c6603", "from_id": "769ce956-6545-4f02-a734-472df18c6603", "from_name": null, "from_type": "Indicator", "id": "991ce91b-9009-4ab8-9e79-44df834aa647", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--4bc7126b-b8d2-5ac7-bd62-ddbb7b41cc18", "toId": "654d0bf9-05af-493f-8190-9d9a916fe0e7", "to_id": "654d0bf9-05af-493f-8190-9d9a916fe0e7", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.589Z", "created_at": "2026-09-26T18:43:25.090Z", "modified": "2026-09-26T18:43:25.587Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:25.587Z" }, "description_available": false, "entity_type": "based-on", "fromId": "25bc00c0-3a98-4573-b418-7260aa16c443", "from_id": "25bc00c0-3a98-4573-b418-7260aa16c443", "from_name": null, "from_type": "Indicator", "id": "9b8a3dfc-c3c0-49bd-a3af-883b4197ff70", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--25675b64-c98a-57dc-b894-8956ab2442f7", "toId": "05860a22-d046-4998-be06-07b8fde85104", "to_id": "05860a22-d046-4998-be06-07b8fde85104", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.607Z", "created_at": "2026-09-26T18:43:33.106Z", "modified": "2026-09-26T18:43:33.770Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:33.770Z" }, "description_available": false, "entity_type": "based-on", "fromId": "28b14970-5fa3-428b-a522-d79d1897f39c", "from_id": "28b14970-5fa3-428b-a522-d79d1897f39c", "from_name": null, "from_type": "Indicator", "id": "9d7df2e8-dd1a-42e9-b639-39f17038ef57", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--6e4c8272-8b28-52c4-bb36-c6de1147bcab", "toId": "72ea39ba-bc7f-461f-b17e-c698b6ddda6a", "to_id": "72ea39ba-bc7f-461f-b17e-c698b6ddda6a", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.582Z", "created_at": "2026-09-26T18:43:24.112Z", "modified": "2026-09-26T18:43:24.524Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:24.524Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ad5a4ebc-0787-426b-88a6-1c70eb8d2b9a", "from_id": "ad5a4ebc-0787-426b-88a6-1c70eb8d2b9a", "from_name": null, "from_type": "Indicator", "id": "a93a0785-b9ae-454a-bcbd-cf613e8b5967", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--91e03fe0-b3b7-54c5-9e4f-48c944d541fb", "toId": "98b50b44-f0af-49ee-8feb-7eec4177f14d", "to_id": "98b50b44-f0af-49ee-8feb-7eec4177f14d", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.573Z", "created_at": "2026-09-26T18:43:20.267Z", "modified": "2026-09-26T18:43:20.649Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:20.649Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fea2f7ff-e1ea-4b05-b39b-10944aa093cc", "from_id": "fea2f7ff-e1ea-4b05-b39b-10944aa093cc", "from_name": null, "from_type": "Indicator", "id": "ab88cd11-5be7-4498-a66c-c9735b78b030", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--e9a58e16-b208-5d99-bcc9-946dfb331bca", "toId": "ddb516ec-80f4-435a-bf24-e7ea5f6ef03b", "to_id": "ddb516ec-80f4-435a-bf24-e7ea5f6ef03b", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.587Z", "created_at": "2026-09-26T18:43:24.581Z", "modified": "2026-09-26T18:43:24.986Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:24.986Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f9820915-a9a2-4069-9949-f7e13a8678fb", "from_id": "f9820915-a9a2-4069-9949-f7e13a8678fb", "from_name": null, "from_type": "Indicator", "id": "aec2e938-8cb2-4340-8fa0-2a72dac0886a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--ee8fa422-d259-55c7-96f1-ed1485c8346d", "toId": "4c3d0e8f-8e6d-4ac1-a944-932af9e665ba", "to_id": "4c3d0e8f-8e6d-4ac1-a944-932af9e665ba", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.552Z", "created_at": "2026-09-26T18:43:16.424Z", "modified": "2026-09-26T18:43:16.881Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:16.881Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c5151b3b-c305-49f4-8682-b4d0b2781ce5", "from_id": "c5151b3b-c305-49f4-8682-b4d0b2781ce5", "from_name": null, "from_type": "Indicator", "id": "b2f2e5e9-51aa-4ff4-8ea7-aa5d35ef737f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--b20305ad-4839-5cc8-a63d-8ba8b40a8a3e", "toId": "756361ab-2069-443d-b79d-68480a0c88ef", "to_id": "756361ab-2069-443d-b79d-68480a0c88ef", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.533Z", "created_at": "2026-09-26T18:43:11.075Z", "modified": "2026-09-26T18:43:12.946Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:12.946Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d713410d-ce98-4542-baa7-c80e216ba030", "from_id": "d713410d-ce98-4542-baa7-c80e216ba030", "from_name": null, "from_type": "Indicator", "id": "b579b7f5-40df-4ba5-a66b-b9179cca4991", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--83d3d468-5dba-5faf-8d8a-9bd05734d82a", "toId": "08870a85-cf7b-4ef0-a58c-6015cfecd735", "to_id": "08870a85-cf7b-4ef0-a58c-6015cfecd735", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.540Z", "created_at": "2026-09-26T18:43:14.167Z", "modified": "2026-09-26T18:43:14.884Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:14.884Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a161e7d1-56aa-420e-86bf-dc511445c215", "from_id": "a161e7d1-56aa-420e-86bf-dc511445c215", "from_name": null, "from_type": "Indicator", "id": "b8e23fd0-6550-4360-92fb-06eefe3b2125", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--ef8574d2-41e9-5607-b804-f23d8b826c80", "toId": "ba8128ff-cee1-4139-a71a-15e3fbc04aca", "to_id": "ba8128ff-cee1-4139-a71a-15e3fbc04aca", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.564Z", "created_at": "2026-09-26T18:43:18.592Z", "modified": "2026-09-26T18:43:19.332Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:19.332Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2f063633-17cc-4772-b674-9afc392c59e0", "from_id": "2f063633-17cc-4772-b674-9afc392c59e0", "from_name": null, "from_type": "Indicator", "id": "b9826985-ce5e-47bd-946a-39c2f7201d16", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--2c673984-8c0f-54fb-8d79-3e2cd5b5e3d6", "toId": "95feb8d5-3485-44a9-8d4b-55bfb35a8e57", "to_id": "95feb8d5-3485-44a9-8d4b-55bfb35a8e57", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.531Z", "created_at": "2026-09-26T18:43:10.776Z", "modified": "2026-09-26T18:43:11.994Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:11.994Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3b3406ec-b471-4d40-bbf4-c24aa0c210eb", "from_id": "3b3406ec-b471-4d40-bbf4-c24aa0c210eb", "from_name": null, "from_type": "Indicator", "id": "bd5a14cc-c662-4020-895b-56640bb36030", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--c1ef5808-b033-55c7-b52d-4fea0bfad7b0", "toId": "acd289b3-8ede-4c9c-87d1-7acea9a90c9e", "to_id": "acd289b3-8ede-4c9c-87d1-7acea9a90c9e", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.561Z", "created_at": "2026-09-26T18:43:18.158Z", "modified": "2026-09-26T18:43:19.045Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:19.045Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b8c3120e-9125-4a1b-a6f1-4285008161c0", "from_id": "b8c3120e-9125-4a1b-a6f1-4285008161c0", "from_name": null, "from_type": "Indicator", "id": "ce354daa-d819-4e69-824b-5c0a773509fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--a3aa306f-f534-567c-94f0-9f25c1deddb7", "toId": "4951d272-b8df-41e8-bb01-a9bf50355f4b", "to_id": "4951d272-b8df-41e8-bb01-a9bf50355f4b", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.577Z", "created_at": "2026-09-26T18:43:20.945Z", "modified": "2026-09-26T18:43:22.340Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:22.340Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9f115f55-6dee-4ece-bba3-d4ba3bb4bd8f", "from_id": "9f115f55-6dee-4ece-bba3-d4ba3bb4bd8f", "from_name": null, "from_type": "Indicator", "id": "cff3c14a-7e02-4770-9b0d-b764242f6288", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--5211f8ba-9576-5d48-bff8-099f9c1fb6a6", "toId": "7bda89d7-25a2-43de-9e2e-a5e74570c27c", "to_id": "7bda89d7-25a2-43de-9e2e-a5e74570c27c", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.559Z", "created_at": "2026-09-26T18:43:17.431Z", "modified": "2026-09-26T18:43:18.092Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:18.092Z" }, "description_available": false, "entity_type": "based-on", "fromId": "da8decea-4150-4b5e-9f18-7c1560ae3266", "from_id": "da8decea-4150-4b5e-9f18-7c1560ae3266", "from_name": null, "from_type": "Indicator", "id": "d143c6c6-84f0-42b0-ab11-f8610e01b4d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--8c415707-638f-5ee7-9db9-7f3379be2e76", "toId": "d6a726e2-abc5-4e0e-9ede-5f9f40de6c00", "to_id": "d6a726e2-abc5-4e0e-9ede-5f9f40de6c00", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.614Z", "created_at": "2026-09-26T18:43:34.484Z", "modified": "2026-09-26T18:43:35.327Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:35.327Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c5223aa8-6c94-47f4-a4e5-e8482e6a6438", "from_id": "c5223aa8-6c94-47f4-a4e5-e8482e6a6438", "from_name": null, "from_type": "Indicator", "id": "de977477-b9db-4db4-a822-688a847b16a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--931707d6-0e94-5982-a2fe-42818a096ad1", "toId": "1cccb83c-3565-4eb2-9f29-9b8cb0aeadf7", "to_id": "1cccb83c-3565-4eb2-9f29-9b8cb0aeadf7", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.603Z", "created_at": "2026-09-26T18:43:33.106Z", "modified": "2026-09-26T18:43:33.643Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:33.643Z" }, "description_available": false, "entity_type": "based-on", "fromId": "16183ca5-dbcb-4f23-990b-11f55413cd7b", "from_id": "16183ca5-dbcb-4f23-990b-11f55413cd7b", "from_name": null, "from_type": "Indicator", "id": "e03e7b1b-bf6f-4217-abac-fdafda45bb61", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--47743c59-deb5-5a78-b3c6-1996a5edcbe3", "toId": "d9158aab-ecea-43ff-a56f-eb2ced467425", "to_id": "d9158aab-ecea-43ff-a56f-eb2ced467425", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.626Z", "created_at": "2026-09-26T18:43:38.031Z", "modified": "2026-09-26T18:43:38.476Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:38.476Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a0ebc941-df6a-44f4-8493-c4d553a76f71", "from_id": "a0ebc941-df6a-44f4-8493-c4d553a76f71", "from_name": null, "from_type": "Indicator", "id": "e7695758-2d57-40de-bde7-aa43623f64b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--aba0bc59-896f-5012-b2c0-b6f0f4d6531f", "toId": "c4f2aab9-c3ce-4ccf-a438-8ccac46938d0", "to_id": "c4f2aab9-c3ce-4ccf-a438-8ccac46938d0", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.619Z", "created_at": "2026-09-26T18:43:36.390Z", "modified": "2026-09-26T18:43:37.250Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:37.250Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0fab30cd-0a7b-4523-8ad5-0350ae6a3558", "from_id": "0fab30cd-0a7b-4523-8ad5-0350ae6a3558", "from_name": null, "from_type": "Indicator", "id": "f4b7a4be-7162-4118-b1a1-97e9621f8511", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--38434b4e-32bf-5d02-96b9-f6413fb81c71", "toId": "69e73cea-d1c7-46d1-96bf-aaf68b151d64", "to_id": "69e73cea-d1c7-46d1-96bf-aaf68b151d64", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.526Z", "created_at": "2026-09-26T18:43:09.952Z", "modified": "2026-09-26T18:43:10.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:10.464Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5e4a5c6a-c170-46b8-8af4-72df3f4893f8", "from_id": "5e4a5c6a-c170-46b8-8af4-72df3f4893f8", "from_name": null, "from_type": "Indicator", "id": "f99130e3-18af-4b60-a931-f3d93d6265f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--c8b6b567-f6f6-5c11-b8ca-3e92d82e1d48", "toId": "c6f1376b-95eb-4a15-9152-cf3e23fca79a", "to_id": "c6f1376b-95eb-4a15-9152-cf3e23fca79a", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.542Z", "created_at": "2026-09-26T18:43:14.963Z", "modified": "2026-09-26T18:43:15.525Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:15.525Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e9a275d3-a10c-4c7e-8110-bb6be69319ae", "from_id": "e9a275d3-a10c-4c7e-8110-bb6be69319ae", "from_name": null, "from_type": "Indicator", "id": "fce4cdcd-0322-4fa3-9bc2-aa915848cf15", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--82c53d3d-1f88-59c4-98d5-bc4c78fbea44", "toId": "6684ef8a-4abc-4ae0-bea0-f10ac3aa1cc4", "to_id": "6684ef8a-4abc-4ae0-bea0-f10ac3aa1cc4", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:54.605Z", "created_at": "2026-09-26T18:43:33.119Z", "modified": "2026-09-26T18:43:33.771Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:43:33.771Z" }, "description_available": false, "entity_type": "based-on", "fromId": "51141c7c-7edc-4469-b255-fed2a1070598", "from_id": "51141c7c-7edc-4469-b255-fed2a1070598", "from_name": null, "from_type": "Indicator", "id": "fe2657fe-72bf-4748-9a34-e899f1d64434", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "standard_id": "relationship--575dbdd2-017e-545d-a8fe-3c0a144e8c2d", "toId": "a039cf35-bf94-4e26-a0a7-7dbb9d30289a", "to_id": "a039cf35-bf94-4e26-a0a7-7dbb9d30289a", "to_name": null, "to_type": "IPv4Addr" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "aeoncredit[.]com[.]cn", "description_available": false, "object_id": "b3963eed-b419-4b4f-8211-7654094add34", "object_ids": [ "4b51069c-f3bd-458a-9d91-efa979cc9ef7", "b3963eed-b419-4b4f-8211-7654094add34" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b3963eed-b419-4b4f-8211-7654094add34", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "aeoncredit.com.cn" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "4b51069c-f3bd-458a-9d91-efa979cc9ef7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "aeoncredit.com.cn" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "aeoncredit.com.cn" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "futurere[.]com[.]kp", "description_available": false, "object_id": "da8decea-4150-4b5e-9f18-7c1560ae3266", "object_ids": [ "d6a726e2-abc5-4e0e-9ede-5f9f40de6c00", "da8decea-4150-4b5e-9f18-7c1560ae3266" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "da8decea-4150-4b5e-9f18-7c1560ae3266", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "futurere.com.kp" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "d6a726e2-abc5-4e0e-9ede-5f9f40de6c00", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "futurere.com.kp" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "futurere.com.kp" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hero-huishan[.]cn", "description_available": false, "object_id": "9f115f55-6dee-4ece-bba3-d4ba3bb4bd8f", "object_ids": [ "7bda89d7-25a2-43de-9e2e-a5e74570c27c", "9f115f55-6dee-4ece-bba3-d4ba3bb4bd8f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9f115f55-6dee-4ece-bba3-d4ba3bb4bd8f", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "hero-huishan.cn" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "7bda89d7-25a2-43de-9e2e-a5e74570c27c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "hero-huishan.cn" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "hero-huishan.cn" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hero-huishan[.]com", "description_available": false, "object_id": "769ce956-6545-4f02-a734-472df18c6603", "object_ids": [ "654d0bf9-05af-493f-8190-9d9a916fe0e7", "769ce956-6545-4f02-a734-472df18c6603" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "769ce956-6545-4f02-a734-472df18c6603", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "hero-huishan.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "654d0bf9-05af-493f-8190-9d9a916fe0e7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "hero-huishan.com" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "hero-huishan.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "kevin[.]com", "description_available": false, "object_id": "e56ddefd-95c0-4e5e-a8a1-b66f1b505c67", "object_ids": [ "6d84e1dc-3412-4b5b-b2c2-1215bd5da7ab", "e56ddefd-95c0-4e5e-a8a1-b66f1b505c67" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e56ddefd-95c0-4e5e-a8a1-b66f1b505c67", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "kevin.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "6d84e1dc-3412-4b5b-b2c2-1215bd5da7ab", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "kevin.com" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "kevin.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "lnnk[.]com", "description_available": false, "object_id": "b8c3120e-9125-4a1b-a6f1-4285008161c0", "object_ids": [ "4951d272-b8df-41e8-bb01-a9bf50355f4b", "b8c3120e-9125-4a1b-a6f1-4285008161c0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b8c3120e-9125-4a1b-a6f1-4285008161c0", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "lnnk.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "4951d272-b8df-41e8-bb01-a9bf50355f4b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "lnnk.com" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "lnnk.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "nkinternet[.]com", "description_available": false, "object_id": "a0ebc941-df6a-44f4-8493-c4d553a76f71", "object_ids": [ "a0ebc941-df6a-44f4-8493-c4d553a76f71", "c4f2aab9-c3ce-4ccf-a438-8ccac46938d0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a0ebc941-df6a-44f4-8493-c4d553a76f71", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "nkinternet.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "c4f2aab9-c3ce-4ccf-a438-8ccac46938d0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "nkinternet.com" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "nkinternet.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "silibank[.]com", "description_available": false, "object_id": "7631ad2e-7f90-4a21-93f6-27ed88580692", "object_ids": [ "62240b4b-4a55-45bd-aabc-8c67cb2e79dc", "7631ad2e-7f90-4a21-93f6-27ed88580692" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7631ad2e-7f90-4a21-93f6-27ed88580692", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "silibank.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "62240b4b-4a55-45bd-aabc-8c67cb2e79dc", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "silibank.com" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "domain", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-01-02T07:35:56.260Z", "validity_status": "active", "value": "silibank.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "175[.]45[.]176[.]21", "description_available": false, "object_id": "5e4a5c6a-c170-46b8-8af4-72df3f4893f8", "object_ids": [ "5e4a5c6a-c170-46b8-8af4-72df3f4893f8", "c6f1376b-95eb-4a15-9152-cf3e23fca79a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5e4a5c6a-c170-46b8-8af4-72df3f4893f8", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.176.21" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "c6f1376b-95eb-4a15-9152-cf3e23fca79a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "175.45.176.21" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.176.21" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "175[.]45[.]176[.]22", "description_available": false, "object_id": "f6d26ded-abc9-4b75-834d-e00260ae5448", "object_ids": [ "ea733a3d-3a24-45a5-8d43-7aae269c2646", "f6d26ded-abc9-4b75-834d-e00260ae5448" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f6d26ded-abc9-4b75-834d-e00260ae5448", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.176.22" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "ea733a3d-3a24-45a5-8d43-7aae269c2646", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "175.45.176.22" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.176.22" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "175[.]45[.]176[.]32", "description_available": false, "object_id": "cc305fda-d098-47b8-a073-a8d97a815a03", "object_ids": [ "9c723dda-b8ec-47ca-b79a-ad79b8188add", "cc305fda-d098-47b8-a073-a8d97a815a03" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "cc305fda-d098-47b8-a073-a8d97a815a03", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.176.32" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "9c723dda-b8ec-47ca-b79a-ad79b8188add", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "175.45.176.32" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.176.32" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "175[.]45[.]177[.]33", "description_available": false, "object_id": "d713410d-ce98-4542-baa7-c80e216ba030", "object_ids": [ "08870a85-cf7b-4ef0-a58c-6015cfecd735", "d713410d-ce98-4542-baa7-c80e216ba030" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d713410d-ce98-4542-baa7-c80e216ba030", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.177.33" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "08870a85-cf7b-4ef0-a58c-6015cfecd735", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "175.45.177.33" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.177.33" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "175[.]45[.]178[.]56", "description_available": false, "object_id": "3b3406ec-b471-4d40-bbf4-c24aa0c210eb", "object_ids": [ "3b3406ec-b471-4d40-bbf4-c24aa0c210eb", "acd289b3-8ede-4c9c-87d1-7acea9a90c9e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3b3406ec-b471-4d40-bbf4-c24aa0c210eb", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.178.56" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "acd289b3-8ede-4c9c-87d1-7acea9a90c9e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "175.45.178.56" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.178.56" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "175[.]45[.]178[.]57", "description_available": false, "object_id": "d138989a-51b7-4c8d-ab3e-b76feb544dbe", "object_ids": [ "83917fff-07d8-4007-ab68-dec0f5d4e236", "d138989a-51b7-4c8d-ab3e-b76feb544dbe" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d138989a-51b7-4c8d-ab3e-b76feb544dbe", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.178.57" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "83917fff-07d8-4007-ab68-dec0f5d4e236", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "175.45.178.57" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "175.45.178.57" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "188[.]43[.]136[.]115", "description_available": false, "object_id": "a161e7d1-56aa-420e-86bf-dc511445c215", "object_ids": [ "a161e7d1-56aa-420e-86bf-dc511445c215", "ba8128ff-cee1-4139-a71a-15e3fbc04aca" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a161e7d1-56aa-420e-86bf-dc511445c215", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "188.43.136.115" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "ba8128ff-cee1-4139-a71a-15e3fbc04aca", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "188.43.136.115" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "188.43.136.115" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "188[.]43[.]136[.]116", "description_available": false, "object_id": "e9a275d3-a10c-4c7e-8110-bb6be69319ae", "object_ids": [ "6684ef8a-4abc-4ae0-bea0-f10ac3aa1cc4", "e9a275d3-a10c-4c7e-8110-bb6be69319ae" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e9a275d3-a10c-4c7e-8110-bb6be69319ae", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "188.43.136.116" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "6684ef8a-4abc-4ae0-bea0-f10ac3aa1cc4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "188.43.136.116" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "188.43.136.116" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]24[.]140[.]88", "description_available": false, "object_id": "ad5a4ebc-0787-426b-88a6-1c70eb8d2b9a", "object_ids": [ "98b50b44-f0af-49ee-8feb-7eec4177f14d", "ad5a4ebc-0787-426b-88a6-1c70eb8d2b9a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ad5a4ebc-0787-426b-88a6-1c70eb8d2b9a", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.140.88" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "98b50b44-f0af-49ee-8feb-7eec4177f14d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.24.140.88" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.140.88" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]24[.]140[.]94", "description_available": false, "object_id": "b25d7245-dc30-4b3d-b09a-c45093069e64", "object_ids": [ "94f66d0d-6f90-46ee-98e5-f1f1777d11bb", "b25d7245-dc30-4b3d-b09a-c45093069e64" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b25d7245-dc30-4b3d-b09a-c45093069e64", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.140.94" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "94f66d0d-6f90-46ee-98e5-f1f1777d11bb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.24.140.94" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.140.94" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]24[.]140[.]95", "description_available": false, "object_id": "f9820915-a9a2-4069-9949-f7e13a8678fb", "object_ids": [ "4c3d0e8f-8e6d-4ac1-a944-932af9e665ba", "f9820915-a9a2-4069-9949-f7e13a8678fb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f9820915-a9a2-4069-9949-f7e13a8678fb", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.140.95" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "4c3d0e8f-8e6d-4ac1-a944-932af9e665ba", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.24.140.95" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.140.95" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]24[.]161[.]240", "description_available": false, "object_id": "25bc00c0-3a98-4573-b418-7260aa16c443", "object_ids": [ "05860a22-d046-4998-be06-07b8fde85104", "25bc00c0-3a98-4573-b418-7260aa16c443" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "25bc00c0-3a98-4573-b418-7260aa16c443", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.161.240" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "05860a22-d046-4998-be06-07b8fde85104", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.24.161.240" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.161.240" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]24[.]161[.]247", "description_available": false, "object_id": "6d77369b-a19a-409a-a628-25a848739119", "object_ids": [ "00523697-93d4-4bf5-b700-2d3a09c909d9", "6d77369b-a19a-409a-a628-25a848739119" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6d77369b-a19a-409a-a628-25a848739119", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.161.247" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "00523697-93d4-4bf5-b700-2d3a09c909d9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.24.161.247" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.24.161.247" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]125[.]144", "description_available": false, "object_id": "c4e3a6bc-86de-497f-aa36-e8989ca73eef", "object_ids": [ "32d5e59b-3ce8-4e53-94ad-f464dac9e86e", "c4e3a6bc-86de-497f-aa36-e8989ca73eef" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c4e3a6bc-86de-497f-aa36-e8989ca73eef", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.144" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "32d5e59b-3ce8-4e53-94ad-f464dac9e86e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.125.144" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.144" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]125[.]150", "description_available": false, "object_id": "e84301b7-ea53-4e57-a8ed-4741e281b4cf", "object_ids": [ "1e9123c6-5ea9-41fa-a344-92cc30d52ff1", "e84301b7-ea53-4e57-a8ed-4741e281b4cf" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e84301b7-ea53-4e57-a8ed-4741e281b4cf", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.150" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "1e9123c6-5ea9-41fa-a344-92cc30d52ff1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.125.150" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.150" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]125[.]158", "description_available": false, "object_id": "e93adba4-2072-45b5-8ed8-8ef669c825a3", "object_ids": [ "06be6b34-b31e-4db1-a003-42e1c119ee0c", "e93adba4-2072-45b5-8ed8-8ef669c825a3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e93adba4-2072-45b5-8ed8-8ef669c825a3", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.158" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "06be6b34-b31e-4db1-a003-42e1c119ee0c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.125.158" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.158" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]125[.]159", "description_available": false, "object_id": "89fdda86-d751-4df2-8e66-a948f8d50bd0", "object_ids": [ "47ce2fad-9ad4-4a0c-8668-a682503d9bed", "89fdda86-d751-4df2-8e66-a948f8d50bd0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "89fdda86-d751-4df2-8e66-a948f8d50bd0", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.159" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "47ce2fad-9ad4-4a0c-8668-a682503d9bed", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.125.159" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.125.159" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]171[.]88", "description_available": false, "object_id": "16183ca5-dbcb-4f23-990b-11f55413cd7b", "object_ids": [ "16183ca5-dbcb-4f23-990b-11f55413cd7b", "d9158aab-ecea-43ff-a56f-eb2ced467425" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "16183ca5-dbcb-4f23-990b-11f55413cd7b", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.171.88" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "d9158aab-ecea-43ff-a56f-eb2ced467425", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.171.88" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.171.88" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]171[.]89", "description_available": false, "object_id": "51141c7c-7edc-4469-b255-fed2a1070598", "object_ids": [ "51141c7c-7edc-4469-b255-fed2a1070598", "a039cf35-bf94-4e26-a0a7-7dbb9d30289a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "51141c7c-7edc-4469-b255-fed2a1070598", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.171.89" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "a039cf35-bf94-4e26-a0a7-7dbb9d30289a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.171.89" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.171.89" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]43[.]208", "description_available": false, "object_id": "28b14970-5fa3-428b-a522-d79d1897f39c", "object_ids": [ "28b14970-5fa3-428b-a522-d79d1897f39c", "72ea39ba-bc7f-461f-b17e-c698b6ddda6a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "28b14970-5fa3-428b-a522-d79d1897f39c", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.208" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "72ea39ba-bc7f-461f-b17e-c698b6ddda6a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.43.208" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.208" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]43[.]211", "description_available": false, "object_id": "a7b5d72d-d496-4080-b4d2-587df0ef294e", "object_ids": [ "7bbf0609-96fa-4ec3-be4a-4b20e739f999", "a7b5d72d-d496-4080-b4d2-587df0ef294e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a7b5d72d-d496-4080-b4d2-587df0ef294e", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.211" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "7bbf0609-96fa-4ec3-be4a-4b20e739f999", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.43.211" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.211" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]43[.]212", "description_available": false, "object_id": "1ed853ad-9369-4364-a8af-b554b9567871", "object_ids": [ "1ed853ad-9369-4364-a8af-b554b9567871", "746f8e45-268a-4aa2-b77e-299c20bd35ea" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1ed853ad-9369-4364-a8af-b554b9567871", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.212" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "746f8e45-268a-4aa2-b77e-299c20bd35ea", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.43.212" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.212" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "218[.]25[.]43[.]223", "description_available": false, "object_id": "43e041db-b4d3-40e0-b1f4-7cf0ca561a1f", "object_ids": [ "43e041db-b4d3-40e0-b1f4-7cf0ca561a1f", "b6e0ef55-e4d6-456d-8286-5140be6c35e6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "43e041db-b4d3-40e0-b1f4-7cf0ca561a1f", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.223" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "b6e0ef55-e4d6-456d-8286-5140be6c35e6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "218.25.43.223" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "218.25.43.223" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "61[.]189[.]49[.]233", "description_available": false, "object_id": "c5223aa8-6c94-47f4-a4e5-e8482e6a6438", "object_ids": [ "1cccb83c-3565-4eb2-9f29-9b8cb0aeadf7", "c5223aa8-6c94-47f4-a4e5-e8482e6a6438" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c5223aa8-6c94-47f4-a4e5-e8482e6a6438", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "61.189.49.233" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "1cccb83c-3565-4eb2-9f29-9b8cb0aeadf7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "61.189.49.233" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "61.189.49.233" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "61[.]189[.]49[.]234", "description_available": false, "object_id": "2cce5a19-792d-4f64-9d8e-6f83e12b9005", "object_ids": [ "2cce5a19-792d-4f64-9d8e-6f83e12b9005", "53715754-4c32-41a6-8c62-ae9538ecd149" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2cce5a19-792d-4f64-9d8e-6f83e12b9005", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "61.189.49.234" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "53715754-4c32-41a6-8c62-ae9538ecd149", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "61.189.49.234" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "61.189.49.234" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "61[.]189[.]49[.]240", "description_available": false, "object_id": "0fab30cd-0a7b-4523-8ad5-0350ae6a3558", "object_ids": [ "0fab30cd-0a7b-4523-8ad5-0350ae6a3558", "69e73cea-d1c7-46d1-96bf-aaf68b151d64" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0fab30cd-0a7b-4523-8ad5-0350ae6a3558", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "61.189.49.240" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "69e73cea-d1c7-46d1-96bf-aaf68b151d64", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "61.189.49.240" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "ipv4", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "61.189.49.240" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b", "description_available": false, "object_id": "02c3a6b9-b500-44d2-b446-56e7879959d3", "object_ids": [ "02c3a6b9-b500-44d2-b446-56e7879959d3", "cee7f66a-839e-4b79-8dd1-b76d20c70f1f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "02c3a6b9-b500-44d2-b446-56e7879959d3", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-07-09T03:50:32.557Z", "validity_status": "active", "value": "5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "cee7f66a-839e-4b79-8dd1-b76d20c70f1f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "sha256", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-07-09T03:50:32.557Z", "validity_status": "active", "value": "5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01", "description_available": false, "object_id": "c5151b3b-c305-49f4-8682-b4d0b2781ce5", "object_ids": [ "756361ab-2069-443d-b79d-68480a0c88ef", "c5151b3b-c305-49f4-8682-b4d0b2781ce5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c5151b3b-c305-49f4-8682-b4d0b2781ce5", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-07-09T03:50:32.557Z", "validity_status": "active", "value": "b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "756361ab-2069-443d-b79d-68480a0c88ef", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "sha256", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2027-07-09T03:50:32.557Z", "validity_status": "active", "value": "b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//silibank[.]com/fog/update_files/", "description_available": false, "object_id": "e772aab5-2b33-4d12-abb8-bef9e84d0171", "object_ids": [ "2f0b246d-9da2-41d0-9952-b629e5c19d5d", "e772aab5-2b33-4d12-abb8-bef9e84d0171" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e772aab5-2b33-4d12-abb8-bef9e84d0171", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "http://silibank.com/fog/update_files/" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "2f0b246d-9da2-41d0-9952-b629e5c19d5d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://silibank.com/fog/update_files/" } ], "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited", "type": "url", "valid_from": "2026-09-21T16:40:48.000Z", "valid_until": "2026-10-11T22:15:27.434Z", "validity_status": "active", "value": "http://silibank.com/fog/update_files/" } ], "mentioned": [], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-21T16:40:47.520Z", "created_at": "2026-09-26T18:54:19.207Z", "modified": "2026-09-26T18:54:19.869Z", "published": "2026-09-21T16:40:47.520Z", "updated_at": "2026-09-26T18:54:19.869Z" }, "description_available": true, "id": "6bf69d7a-a794-4f45-bc97-7fd46d5c822d", "is_inferred": false, "labels": [ "certificate hierarchy", "cross-border infrastructure", "hangro", "mail relay systems", "north korea networks", "silibank", "softether", "vpn infrastructure" ], "lang": "en", "name": "North Korea's Hangro Revisited", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-21T16:40:47.520Z", "references": [ { "external_id": null, "id": "0cd05be5-29ee-487c-940f-848fd5b6c9f4", "source_name": "alien-vault", "url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited" }, { "external_id": "6ab15e0fe200afb0f82b8895", "id": "46b99cec-1576-436b-9a92-79342db63399", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ab15e0fe200afb0f82b8895" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "6bf69d7a-a794-4f45-bc97-7fd46d5c822d", "schema_version": 1, "selected_date": "2026-09-21", "source_url": "https://blog.synapticsystems.de/north-koreas-hangro-revisited" }