{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 4, "direct_entities": 14, "direct_relationships": 13, "invalid_iocs": 2, "iocs": 6, "mentioned": 1, "mitre_associated": 0, "mitre_direct": 0, "targets": 1, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 36, "excluded_graph_objects": 144, "graph_complete": true, "graph_objects": 14, "graph_relationships": 13, "mitre_context_complete": true, "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "status_as_of": "2026-10-10T13:30:44+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.374Z", "created_at": "2026-09-26T18:32:28.943Z", "modified": "2026-09-26T18:32:47.002Z", "updated_at": "2026-09-26T18:32:47.002Z" }, "description_available": true, "entity_type": "Indicator", "id": "01a5168a-24a1-450c-982d-16571e4db3e8", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "hygiene", "payload", "sysvol abuse", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "indicator--4db641d5-032c-56c9-99c6-d8e8caa946e1", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:32:26.834Z", "updated_at": "2026-09-26T18:32:27.545Z" }, "description_available": false, "entity_type": "StixFile", "id": "0543e4ab-c686-4961-9eec-406e279ca43c", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "payload", "sysvol abuse", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "file--0c7ae08a-d991-5f59-b175-621c06fd410b", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:32:26.828Z", "updated_at": "2026-09-26T18:32:27.542Z" }, "description_available": false, "entity_type": "StixFile", "id": "194a774a-7274-466c-bbad-6172847b4617", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "payload", "sysvol abuse", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "file--1048502d-a056-53bb-a41f-0c2df8ce8833", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:32:24.403Z", "updated_at": "2026-09-26T18:32:31.464Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "43157b64-a2b0-426d-a233-01ff1637fe08", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "hygiene", "payload", "sysvol abuse", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "ipv4-addr--dcfb624b-4012-5e14-ae52-203ef93a19a5", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:32:27.883Z", "updated_at": "2026-09-26T18:32:40.636Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "52b23085-74c1-47de-b9f5-943ebc22bb99", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "hygiene", "payload", "sysvol abuse", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "ipv4-addr--bcef56c5-e23e-545a-93df-6ec9a2aa436c", "type": "IPv4Addr" }, { "__typename": "Malware", "aliases": [ "elf.payload", "win.payload" ], "attributes": { "is_family": true, "malware_types": [ "dropper" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-04-09T20:32:39.897Z", "created_at": "2026-04-09T22:51:19.938Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-09T08:07:42.120Z", "updated_at": "2026-10-09T08:07:42.120Z" }, "description_available": true, "entity_type": "Malware", "id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "is_inferred": false, "labels": [ "downloader", "elf", "payload_delivery", "ssh-worm" ], "lang": "en", "name": "Payload", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "3cf3c4a9-70d1-44af-bfa3-14b276b7c2a0", "source_name": "malpedia", "url": "https://0x3obad.github.io/posts/payload-ransomware-writeup/" }, { "external_id": null, "id": "eef84451-8b31-4ca8-bd9f-ede848ff4a66", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/elf.payload" }, { "external_id": null, "id": "afecdc13-b105-458b-89e3-65ceb491f7f1", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.payload" }, { "external_id": null, "id": "2b864516-3ff1-4908-9002-a19d2eef0f8b", "source_name": "malpedia", "url": "https://www.egfincirt.org.eg/payload-ransomware" }, { "external_id": null, "id": "0615bf25-9148-4e87-880d-6c641882726d", "source_name": "malpedia", "url": "https://www.egfincirt.org.eg/payload-ransomware/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "malware--96c3e56b-0bfb-5232-844a-513d2bab6b84", "type": "Malware" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:32:24.890Z", "updated_at": "2026-09-26T18:32:36.373Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "719d6251-6ca3-490a-9f59-7161d9b6a521", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "hygiene", "payload", "sysvol abuse", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "ipv4-addr--92428488-368f-5200-a467-acc54985ef63", "type": "IPv4Addr" }, { "__typename": "Sector", "aliases": [ "ICS", "Industrial Control Systems", "Utilities", "industrial" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:12.982Z", "modified": "2026-02-05T15:16:55.400Z", "updated_at": "2026-02-05T15:16:55.400Z" }, "description_available": true, "entity_type": "Sector", "id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "is_inferred": false, "labels": [], "lang": "en", "name": "Manufacturing", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "identity--3b7bc57f-b0b6-5dc2-a816-6406ae1d6da1", "type": "Sector" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:32:24.652Z", "updated_at": "2026-09-26T18:32:33.580Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "84ebd302-abb4-43cf-98d7-0d1f277fb486", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "payload", "sysvol abuse", "vpn compromise" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "ipv4-addr--4f232fb1-4b86-5b1b-97bb-727950d9b584", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.377Z", "created_at": "2026-09-26T18:32:28.943Z", "modified": "2026-09-26T18:33:47.386Z", "updated_at": "2026-09-26T18:33:47.386Z" }, "description_available": true, "entity_type": "Indicator", "id": "aa5a88e6-7790-4558-b3b4-3634d79121b6", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "hygiene", "payload", "sysvol abuse", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "indicator--b269c97d-f875-5dac-9746-915541e0c383", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.381Z", "created_at": "2026-09-26T18:32:29.674Z", "modified": "2026-09-26T18:32:47.966Z", "updated_at": "2026-09-26T18:32:47.966Z" }, "description_available": true, "entity_type": "Indicator", "id": "b107ca0e-df25-4d83-b268-9153c3389f48", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "payload", "sysvol abuse", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "indicator--23262831-16d2-53ea-ae15-9a0b900c2fc5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.384Z", "created_at": "2026-09-26T18:32:31.960Z", "modified": "2026-09-26T18:32:51.561Z", "updated_at": "2026-09-26T18:32:51.561Z" }, "description_available": false, "entity_type": "Indicator", "id": "b84b79ba-173c-42a7-b7c9-77f31ee78b81", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "payload", "sysvol abuse", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "indicator--fbff85b4-37de-5112-abd5-46a3bd930de5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 15 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.389Z", "created_at": "2026-09-26T18:32:33.939Z", "modified": "2026-09-26T18:32:54.384Z", "updated_at": "2026-09-26T18:32:54.384Z" }, "description_available": true, "entity_type": "Indicator", "id": "e4c1f5c4-d5c5-42af-b51c-17813180e0f9", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "hygiene", "payload", "sysvol abuse", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "indicator--7549ea20-a975-5b25-a31d-db97664ad2db", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.387Z", "created_at": "2026-09-26T18:32:33.891Z", "modified": "2026-09-26T18:32:57.261Z", "updated_at": "2026-09-26T18:32:57.261Z" }, "description_available": false, "entity_type": "Indicator", "id": "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "payload", "sysvol abuse", "vpn compromise" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "indicator--3ccb1b1b-9399-500c-af9e-de15349408f0", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.390Z", "created_at": "2026-09-26T18:33:05.454Z", "modified": "2026-09-26T18:33:06.031Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:06.031Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e4c1f5c4-d5c5-42af-b51c-17813180e0f9", "from_id": "e4c1f5c4-d5c5-42af-b51c-17813180e0f9", "from_name": null, "from_type": "Indicator", "id": "0e348563-dc6f-44d4-b59b-9f159bae496c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--87e07cde-b4ac-57e8-b47d-e6c80e5e47eb", "toId": "52b23085-74c1-47de-b9f5-943ebc22bb99", "to_id": "52b23085-74c1-47de-b9f5-943ebc22bb99", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.378Z", "created_at": "2026-09-26T18:33:02.821Z", "modified": "2026-09-26T18:33:03.273Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:03.273Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aa5a88e6-7790-4558-b3b4-3634d79121b6", "from_id": "aa5a88e6-7790-4558-b3b4-3634d79121b6", "from_name": null, "from_type": "Indicator", "id": "10cfa76f-0a2f-4e81-815b-ba828c614ec7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--003f4bc8-1734-5740-8268-47ff9229ccca", "toId": "43157b64-a2b0-426d-a233-01ff1637fe08", "to_id": "43157b64-a2b0-426d-a233-01ff1637fe08", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.376Z", "created_at": "2026-09-26T18:33:02.252Z", "modified": "2026-09-26T18:33:02.449Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:02.449Z" }, "description_available": false, "entity_type": "based-on", "fromId": "01a5168a-24a1-450c-982d-16571e4db3e8", "from_id": "01a5168a-24a1-450c-982d-16571e4db3e8", "from_name": null, "from_type": "Indicator", "id": "15803621-a5c1-4206-ae17-71299eafc3e1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--59f95681-080d-51ea-aff9-13b75049925c", "toId": "719d6251-6ca3-490a-9f59-7161d9b6a521", "to_id": "719d6251-6ca3-490a-9f59-7161d9b6a521", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.373Z", "created_at": "2026-09-26T18:32:34.667Z", "modified": "2026-09-26T18:32:35.224Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:32:35.224Z" }, "description_available": false, "entity_type": "targets", "fromId": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "from_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "from_name": "Payload", "from_type": "Malware", "id": "2510ef6a-d59d-4a71-b76b-ad36bbe3e1cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--06c8b260-d7a7-5c34-a9f1-3adc3f0db7e8", "toId": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8", "to_name": "Manufacturing", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.385Z", "created_at": "2026-09-26T18:33:04.025Z", "modified": "2026-09-26T18:33:04.899Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:04.899Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b84b79ba-173c-42a7-b7c9-77f31ee78b81", "from_id": "b84b79ba-173c-42a7-b7c9-77f31ee78b81", "from_name": null, "from_type": "Indicator", "id": "2c66cd69-bcaf-4056-bad1-13bef5d97bc9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--5ce6130b-96fd-5233-9fff-40d54ff1e4e6", "toId": "194a774a-7274-466c-bbad-6172847b4617", "to_id": "194a774a-7274-466c-bbad-6172847b4617", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.458Z", "created_at": "2026-09-26T18:34:09.987Z", "modified": "2026-09-26T18:34:10.169Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:34:10.169Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e4c1f5c4-d5c5-42af-b51c-17813180e0f9", "from_id": "e4c1f5c4-d5c5-42af-b51c-17813180e0f9", "from_name": null, "from_type": "Indicator", "id": "442a887e-b4bc-4b58-9afa-291c0aaf7e96", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--cb2c00e2-19ec-5d48-bf20-9a6080826337", "toId": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_name": "Payload", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.425Z", "created_at": "2026-09-26T18:33:31.946Z", "modified": "2026-09-26T18:33:32.393Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:32.393Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b107ca0e-df25-4d83-b268-9153c3389f48", "from_id": "b107ca0e-df25-4d83-b268-9153c3389f48", "from_name": null, "from_type": "Indicator", "id": "4ef14d07-bf54-499a-991a-1dbb4c867376", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--e47d5079-90f7-5223-863f-864ca68bb95b", "toId": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_name": "Payload", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.446Z", "created_at": "2026-09-26T18:33:57.207Z", "modified": "2026-09-26T18:33:57.658Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:57.658Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606", "from_id": "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606", "from_name": null, "from_type": "Indicator", "id": "7245dc71-4c68-4eea-9575-d2748afc4ffa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--113aa392-e014-569b-8ff0-1ef8321e499f", "toId": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_name": "Payload", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.383Z", "created_at": "2026-09-26T18:33:03.167Z", "modified": "2026-09-26T18:33:03.522Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:03.522Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b107ca0e-df25-4d83-b268-9153c3389f48", "from_id": "b107ca0e-df25-4d83-b268-9153c3389f48", "from_name": null, "from_type": "Indicator", "id": "74354a9d-5d66-4ae2-852d-2be372b381aa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--c8313820-4aa7-5c28-ba82-5c7524727fa9", "toId": "84ebd302-abb4-43cf-98d7-0d1f277fb486", "to_id": "84ebd302-abb4-43cf-98d7-0d1f277fb486", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.388Z", "created_at": "2026-09-26T18:33:04.170Z", "modified": "2026-09-26T18:33:05.166Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:05.166Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606", "from_id": "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606", "from_name": null, "from_type": "Indicator", "id": "7e82acc0-6494-46f9-9a34-e6fbeeafd26f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--370713af-79a7-59b7-b719-758b266d4eba", "toId": "0543e4ab-c686-4961-9eec-406e279ca43c", "to_id": "0543e4ab-c686-4961-9eec-406e279ca43c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.402Z", "created_at": "2026-09-26T18:33:20.648Z", "modified": "2026-09-26T18:33:20.850Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:20.850Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aa5a88e6-7790-4558-b3b4-3634d79121b6", "from_id": "aa5a88e6-7790-4558-b3b4-3634d79121b6", "from_name": null, "from_type": "Indicator", "id": "c73f1aaa-bc7a-4c7c-873f-80917759d100", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--ef57e7e9-0976-58e3-80fc-09b3eb664334", "toId": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_name": "Payload", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.391Z", "created_at": "2026-09-26T18:33:08.485Z", "modified": "2026-09-26T18:33:08.863Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:08.863Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01a5168a-24a1-450c-982d-16571e4db3e8", "from_id": "01a5168a-24a1-450c-982d-16571e4db3e8", "from_name": null, "from_type": "Indicator", "id": "dc3ba509-6f32-49fa-a442-71e03f871fd2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--acee546e-4104-5bc2-98ca-9d6d6b586340", "toId": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_name": "Payload", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:49.435Z", "created_at": "2026-09-26T18:33:44.880Z", "modified": "2026-09-26T18:33:45.062Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:33:45.062Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b84b79ba-173c-42a7-b7c9-77f31ee78b81", "from_id": "b84b79ba-173c-42a7-b7c9-77f31ee78b81", "from_name": null, "from_type": "Indicator", "id": "e17fb2fe-fb06-43d7-a4a7-7746be0b0e0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "standard_id": "relationship--4143a497-ac5b-54d9-be40-0a22794a0aeb", "toId": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "to_name": "Payload", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "104[.]164[.]55[.]46", "description_available": true, "object_id": "b107ca0e-df25-4d83-b268-9153c3389f48", "object_ids": [ "84ebd302-abb4-43cf-98d7-0d1f277fb486", "b107ca0e-df25-4d83-b268-9153c3389f48" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b107ca0e-df25-4d83-b268-9153c3389f48", "valid_from": "2026-09-21T15:23:26.000Z", "valid_until": "2026-10-11T20:58:05.434Z", "validity_status": "active", "value": "104.164.55.46" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "84ebd302-abb4-43cf-98d7-0d1f277fb486", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "104.164.55.46" } ], "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "type": "ipv4", "valid_from": "2026-09-21T15:23:26.000Z", "valid_until": "2026-10-11T20:58:05.434Z", "validity_status": "active", "value": "104.164.55.46" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "146[.]70[.]117[.]239", "description_available": true, "object_id": "e4c1f5c4-d5c5-42af-b51c-17813180e0f9", "object_ids": [ "52b23085-74c1-47de-b9f5-943ebc22bb99", "e4c1f5c4-d5c5-42af-b51c-17813180e0f9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e4c1f5c4-d5c5-42af-b51c-17813180e0f9", "valid_from": "2026-09-21T15:23:26.000Z", "valid_until": "2026-09-21T15:23:27.000Z", "validity_status": "revoked", "value": "146.70.117.239" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "52b23085-74c1-47de-b9f5-943ebc22bb99", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "146.70.117.239" } ], "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "type": "ipv4", "valid_from": "2026-09-21T15:23:26.000Z", "valid_until": "2026-09-21T15:23:27.000Z", "validity_status": "revoked", "value": "146.70.117.239" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "defanged": "149[.]102[.]229[.]154", "description_available": false, "object_id": "43157b64-a2b0-426d-a233-01ff1637fe08", "object_ids": [ "43157b64-a2b0-426d-a233-01ff1637fe08" ], "source_objects": [ { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "43157b64-a2b0-426d-a233-01ff1637fe08", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "149.102.229.154" } ], "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "type": "ipv4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "149.102.229.154" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "defanged": "37[.]19[.]210[.]12", "description_available": false, "object_id": "719d6251-6ca3-490a-9f59-7161d9b6a521", "object_ids": [ "719d6251-6ca3-490a-9f59-7161d9b6a521" ], "source_objects": [ { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "719d6251-6ca3-490a-9f59-7161d9b6a521", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "37.19.210.12" } ], "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "type": "ipv4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "37.19.210.12" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0108656a3e1ade6ca4f21b084f5e1208", "description_available": false, "object_id": "b84b79ba-173c-42a7-b7c9-77f31ee78b81", "object_ids": [ "194a774a-7274-466c-bbad-6172847b4617", "b84b79ba-173c-42a7-b7c9-77f31ee78b81" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b84b79ba-173c-42a7-b7c9-77f31ee78b81", "valid_from": "2026-09-21T11:54:11.000Z", "valid_until": "2027-07-08T23:03:55.557Z", "validity_status": "active", "value": "0108656a3e1ade6ca4f21b084f5e1208" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "194a774a-7274-466c-bbad-6172847b4617", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0108656a3e1ade6ca4f21b084f5e1208" } ], "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "type": "md5", "valid_from": "2026-09-21T11:54:11.000Z", "valid_until": "2027-07-08T23:03:55.557Z", "validity_status": "active", "value": "0108656a3e1ade6ca4f21b084f5e1208" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "bea5e267f24d7da59f6821bffdbff293", "description_available": false, "object_id": "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606", "object_ids": [ "0543e4ab-c686-4961-9eec-406e279ca43c", "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f8ad1f84-3329-48f9-bf3b-3e2e1a83b606", "valid_from": "2026-09-21T11:54:11.000Z", "valid_until": "2027-07-08T23:03:55.557Z", "validity_status": "active", "value": "bea5e267f24d7da59f6821bffdbff293" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0543e4ab-c686-4961-9eec-406e279ca43c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "bea5e267f24d7da59f6821bffdbff293" } ], "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "type": "md5", "valid_from": "2026-09-21T11:54:11.000Z", "valid_until": "2027-07-08T23:03:55.557Z", "validity_status": "active", "value": "bea5e267f24d7da59f6821bffdbff293" } ], "mentioned": [ { "confidence": 50, "evidence_id": "58b3acd5-54be-4c44-b22a-eed113ff94a5", "name": "Payload", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-21T11:54:10.180Z", "created_at": "2026-09-26T18:34:29.656Z", "modified": "2026-09-26T18:34:29.960Z", "published": "2026-09-21T11:54:10.180Z", "updated_at": "2026-09-26T18:34:29.960Z" }, "description_available": true, "id": "86589530-bb2e-476f-bbca-2076dafd9de9", "is_inferred": false, "labels": [ "active directory", "data exfiltration", "domain controller", "encryptionless extortion", "esxi targeting", "gpo abuse", "group policy object", "payload", "sysvol abuse", "vpn compromise" ], "lang": "en", "name": "PAYLOAD ransomware attacks through Active Directory GPO", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-21T11:54:10.180Z", "references": [ { "external_id": null, "id": "1ebbff7f-6f08-48d9-af77-6e072401cbdf", "source_name": "alien-vault", "url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, { "external_id": "6ab11ae202d2117effed327a", "id": "1c58b98c-a04e-48ec-85c7-7b6e36c713d4", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ab11ae202d2117effed327a" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }, "targets": [ { "confidence": 50, "evidence_id": "2510ef6a-d59d-4a71-b76b-ad36bbe3e1cd", "name": "Manufacturing", "role": "cible déclarée (relation targets)", "type": "Sector" } ], "techniques": [], "vulnerabilities": [] }, "report_id": "86589530-bb2e-476f-bbca-2076dafd9de9", "schema_version": 1, "selected_date": "2026-09-21", "source_url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/" }