{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 4, "deduplicated_iocs": 11, "direct_entities": 36, "direct_relationships": 92, "invalid_iocs": 0, "iocs": 11, "mentioned": 9, "mitre_associated": 9, "mitre_direct": 1, "targets": 3, "techniques": 1, "unsupported_indicators": 2, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 510, "excluded_graph_objects": 397, "graph_complete": true, "graph_objects": 36, "graph_relationships": 92, "mitre_context_complete": true, "source_url": "https://asec.ahnlab.com/en/95519/", "status_as_of": "2026-10-10T13:50:29+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:24.570Z", "updated_at": "2026-09-26T18:54:24.975Z" }, "description_available": false, "entity_type": "StixFile", "id": "0441b824-dbb6-4b77-a143-1e512dd8ae05", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--46932ab2-fdac-5e58-8f0d-b5d504cc56dd", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.602Z", "created_at": "2026-09-26T18:54:32.073Z", "modified": "2026-09-26T18:54:49.946Z", "updated_at": "2026-09-26T18:54:49.946Z" }, "description_available": false, "entity_type": "Indicator", "id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--0279a7c5-41cd-52ed-ada6-556a7f38a557", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.600Z", "created_at": "2026-09-26T18:54:32.068Z", "modified": "2026-09-26T18:54:47.999Z", "updated_at": "2026-09-26T18:54:47.999Z" }, "description_available": false, "entity_type": "Indicator", "id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--7f4dc6bd-40e5-5f41-9e66-ec71b329d9af", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:36:33.627Z", "modified": "2026-01-18T14:36:33.875Z", "updated_at": "2026-01-18T14:36:33.875Z" }, "description_available": false, "entity_type": "Region", "id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "is_inferred": false, "labels": [], "lang": "en", "name": "Southern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "location--80f5d85d-4b4f-5cb7-b7aa-1771c0afad2e", "type": "Region" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:23.295Z", "updated_at": "2026-09-26T18:54:23.965Z" }, "description_available": false, "entity_type": "Hostname", "id": "106db67e-675c-49a2-97f3-c0db143cb35e", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "hostname--d0232c88-5a17-5a82-bd1d-9f8d1e8d5d02", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:21.885Z", "updated_at": "2026-09-26T18:54:22.538Z" }, "description_available": false, "entity_type": "StixFile", "id": "21747585-e7f5-472d-a4be-4d1746195f5a", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--c6579e1b-23d0-5e4f-ac2b-c726a763b5b4", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:22.426Z", "updated_at": "2026-09-26T18:54:22.579Z" }, "description_available": false, "entity_type": "StixFile", "id": "23079917-2b9f-467f-ab29-456bc011fbbf", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--4134516d-d6c5-5cc3-86ab-a85d3035fc02", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.597Z", "created_at": "2026-09-26T18:54:31.973Z", "modified": "2026-09-26T18:54:53.421Z", "updated_at": "2026-09-26T18:54:53.421Z" }, "description_available": false, "entity_type": "Indicator", "id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--aceb1ab0-571c-5f0c-9fc2-1ebfc57c0631", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:35:45.994Z", "modified": "2026-01-18T14:35:46.389Z", "updated_at": "2026-01-18T14:35:46.389Z" }, "description_available": false, "entity_type": "Region", "id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "is_inferred": false, "labels": [], "lang": "en", "name": "Sub-Saharan Africa", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "location--69cc1e68-fe91-514a-84c6-3379e0109bc3", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.610Z", "created_at": "2026-09-26T18:54:34.757Z", "modified": "2026-09-26T18:54:59.062Z", "updated_at": "2026-09-26T18:54:59.062Z" }, "description_available": false, "entity_type": "Indicator", "id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--3ec55939-d1e8-554f-b210-23d2e016bddb", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.582Z", "created_at": "2026-09-26T18:54:26.526Z", "modified": "2026-09-26T18:54:31.928Z", "updated_at": "2026-09-26T18:54:31.928Z" }, "description_available": false, "entity_type": "Indicator", "id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--5236fcf5-cc3d-567b-9901-db0f45a92308", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.590Z", "created_at": "2026-09-26T18:54:30.247Z", "modified": "2026-09-26T18:54:39.859Z", "updated_at": "2026-09-26T18:54:39.859Z" }, "description_available": false, "entity_type": "Indicator", "id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--efed40dc-2315-5073-9590-2212ec295889", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:15:56.981Z", "created_at": "2026-02-26T09:06:06.821Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-02-26T09:06:08.284Z", "updated_at": "2026-02-26T09:06:08.284Z" }, "description_available": false, "entity_type": "Malware", "id": "65de75f2-577f-475e-9394-05450cc05a45", "is_inferred": false, "labels": [], "lang": "en", "name": "LummaC2", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "malware--58dd33b2-647b-5c42-89e8-09b5f64b9469", "type": "Malware" }, { "__typename": "Sector", "aliases": [ "Financial", "Financial Industry (FI)", "Financial Services", "Financial-Services" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.391Z", "created_at": "2026-01-18T14:35:07.063Z", "modified": "2026-01-22T20:49:24.280Z", "updated_at": "2026-01-22T20:49:24.280Z" }, "description_available": true, "entity_type": "Sector", "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "is_inferred": false, "labels": [], "lang": "en", "name": "Finance", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7", "type": "Sector" }, { "__typename": "Country", "aliases": [ "IN", "IND" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.044Z", "created_at": "2026-01-18T14:36:34.563Z", "modified": "2026-01-26T13:48:21.782Z", "updated_at": "2026-01-26T13:48:21.782Z" }, "description_available": false, "entity_type": "Country", "id": "6926835d-28e0-4787-97c9-699d0375b12b", "is_inferred": false, "labels": [], "lang": "en", "name": "India", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "location--0bd9fe72-1184-515b-98b8-6341b3b27996", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.585Z", "created_at": "2026-09-26T18:54:26.532Z", "modified": "2026-09-26T18:54:37.647Z", "updated_at": "2026-09-26T18:54:37.647Z" }, "description_available": false, "entity_type": "Indicator", "id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--d1f13c47-743e-59a7-a9d4-bb9fafb248e8", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:25.530Z", "updated_at": "2026-09-26T18:54:25.891Z" }, "description_available": false, "entity_type": "StixFile", "id": "7c7e7bec-7319-476c-95df-39cf14affd0a", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--f1b69818-cd03-54b8-ab67-6f22eb187c5f", "type": "StixFile" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:36:26.119Z", "modified": "2026-01-18T14:36:26.275Z", "updated_at": "2026-01-18T14:36:26.275Z" }, "description_available": false, "entity_type": "Region", "id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "is_inferred": false, "labels": [], "lang": "en", "name": "Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "location--68241bf7-96c8-5542-b488-3b8fe8f51aff", "type": "Region" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:25.440Z", "updated_at": "2026-09-26T18:54:25.890Z" }, "description_available": false, "entity_type": "StixFile", "id": "8a2da631-c2a5-4ff3-9131-daee7696c8c3", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--93ea3b83-7d5b-598c-b36e-f4fd2d5e728c", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.607Z", "created_at": "2026-09-26T18:54:34.754Z", "modified": "2026-09-26T18:55:01.554Z", "updated_at": "2026-09-26T18:55:01.554Z" }, "description_available": false, "entity_type": "Indicator", "id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--dd239c0c-e21f-5426-b9d0-fa2ad84ca0a1", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:36.999Z", "created_at": "2026-01-18T14:35:39.076Z", "modified": "2026-01-18T14:35:40.483Z", "updated_at": "2026-01-18T14:35:40.483Z" }, "description_available": false, "entity_type": "Region", "id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "is_inferred": false, "labels": [], "lang": "en", "name": "Africa", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "location--7e13827c-720f-5725-978b-907dc66a6f6f", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.587Z", "created_at": "2026-09-26T18:54:26.533Z", "modified": "2026-09-26T18:54:35.646Z", "updated_at": "2026-09-26T18:54:35.646Z" }, "description_available": false, "entity_type": "Indicator", "id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--5504592f-cb94-53dd-9d29-379c4088432b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.605Z", "created_at": "2026-09-26T18:54:34.747Z", "modified": "2026-09-26T18:54:57.251Z", "updated_at": "2026-09-26T18:54:57.251Z" }, "description_available": false, "entity_type": "Indicator", "id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--abd31931-d63b-5a97-be0a-7e6eb2551e65", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-20T00:16:27.005Z", "created_at": "2026-04-17T16:34:25.139Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-04-17T16:34:25.656Z", "updated_at": "2026-04-17T16:34:25.656Z" }, "description_available": false, "entity_type": "Malware", "id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "is_inferred": false, "labels": [], "lang": "en", "name": "ACRStealer", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "malware--8b8c1de4-4442-575c-b30b-26b470b8a96f", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:23.299Z", "updated_at": "2026-09-26T18:54:23.966Z" }, "description_available": false, "entity_type": "StixFile", "id": "c249d5a8-bb2a-4675-9414-cb305cedcb3c", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--7975611c-e43f-535d-bfda-d75bfd432dcc", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:21.892Z", "updated_at": "2026-09-26T18:54:22.539Z" }, "description_available": false, "entity_type": "StixFile", "id": "cd8bd88d-ae6b-489d-8a4b-579aa845101e", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--f0bcef0b-cca4-5265-9473-5a9dbfa4b85a", "type": "StixFile" }, { "__typename": "Malware", "aliases": [ "win.vidar" ], "attributes": { "is_family": false, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T19:55:22.473Z", "created_at": "2026-01-19T02:35:26.049Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-09T09:24:18.779Z", "updated_at": "2026-10-09T09:24:18.779Z" }, "description_available": true, "entity_type": "Malware", "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "is_inferred": false, "labels": [ "none", "payload" ], "lang": "en", "name": "Vidar", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "b07168f5-8437-4277-8a54-c9b0684243e8", "source_name": "CISA Scattered Spider Advisory November 2023", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a" }, { "external_id": null, "id": "fdc366e9-5d5c-4df6-bf9a-e88e5fe2c97a", "source_name": "Crowdstrike GTR2020 Mar 2020", "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf" }, { "external_id": null, "id": "a3a42365-4ea0-4d07-82fc-d8c82cfae72c", "source_name": "Google Cloud Threat Intelligence UNC5537 Snowflake 2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion" }, { "external_id": null, "id": "27e6d3ed-714e-413d-b0a6-1349a7a7d09b", "source_name": "SecureWorks Infostealers 2023", "url": "https://www.secureworks.com/research/the-growing-threat-from-infostealers" }, { "external_id": null, "id": "315614d7-7c65-4419-a167-40bb4db07b85", "source_name": "ThreatFox source reference", "url": "https://www.netskope.com/jp/blog/openclaw-hologram-fake-installer-ships-rust-infostealer" }, { "external_id": null, "id": "4d3b593a-fcd6-4e4b-acba-dc408fcddff7", "source_name": "alien-vault", "url": "https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/" }, { "external_id": null, "id": "161f170f-63e6-44eb-b6f8-7c0cf4b17c97", "source_name": "alien-vault", "url": "https://www.netskope.com/blog/100k-in-crypto-drained-by-the-underground-operation" }, { "external_id": null, "id": "ce02fb10-84f3-492c-9e33-56b2c8dd3e27", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus" }, { "external_id": null, "id": "c18f8042-10bc-41a5-abfd-f63080e34db5", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak" }, { "external_id": null, "id": "a79f9cc2-2aba-4526-a227-7f4eb96744c2", "source_name": "malpedia", "url": "https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/" }, { "external_id": null, "id": "b5ce39c9-b188-4d8c-a19f-c6e01bd3f50f", "source_name": "malpedia", "url": "https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/" }, { "external_id": null, "id": "0636d89a-e1ae-4fe0-b613-f7f10fcf360d", "source_name": "malpedia", "url": "https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign" }, { "external_id": null, "id": "ab97bac8-5bea-4d1c-9402-5d566be242f3", "source_name": "malpedia", "url": "https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/" }, { "external_id": null, "id": "7620bd6e-959f-47c9-8383-b14412fdb3ed", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/22932/" }, { "external_id": null, "id": "74501a51-5a3f-4ab5-81aa-1af41dfc2a61", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/30445/" }, { "external_id": null, "id": "1ea065cd-3334-4f40-865f-37f8c7250eb2", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/30875/" }, { "external_id": null, "id": "ebdc2405-ff27-42a8-87d1-b4002ff0da87", "source_name": "malpedia", "url": "https://asec.ahnlab.com/ko/25837/" }, { "external_id": null, "id": "c40f38b9-28ed-483b-8728-b60834377d6a", "source_name": "malpedia", "url": "https://aviab1.github.io/Vidar-Stealer/" }, { "external_id": null, "id": "882a4b2e-61ed-4c20-b475-6fd3b8cf1170", "source_name": "malpedia", "url": "https://aviab1.github.io/blog/vidar-stealer/" }, { "external_id": null, "id": "25d4aa54-82c9-4f86-9ab1-8866c603fdae", "source_name": "malpedia", "url": "https://blog.cyble.com/2022/11/08/massive-youtube-campaign-targeting-over-100-applications-to-deliver-info-stealer/" }, { "external_id": null, "id": "4b04e91f-69ed-4ee6-92ee-2870c0b24b7a", "source_name": "malpedia", "url": "https://blog.jaalma.io/vidar-infostealer-analysis/" }, { "external_id": null, "id": "f37f9192-a65d-4c0a-aad2-8c675db1abe2", "source_name": "malpedia", "url": "https://blog.malwarebytes.com/threat-analysis/2019/01/vidar-gandcrab-stealer-and-ransomware-combo-observed-in-the-wild/" }, { "external_id": null, "id": "e01a3ae4-657d-49f1-a294-5645264c1971", "source_name": "malpedia", "url": "https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/" }, { "external_id": null, "id": "30e6b853-b8a0-41d0-84c7-ad5f2018a2f4", "source_name": "malpedia", "url": "https://blog.minerva-labs.com/vidar-stealer-evasion-arsenal" }, { "external_id": null, "id": "3a386a0a-a61e-4840-8d91-1d7aafce6263", "source_name": "malpedia", "url": "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/" }, { "external_id": null, "id": "548d2d9d-84e8-4a6d-a7b5-4093b981f5c5", "source_name": "malpedia", "url": "https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/" }, { "external_id": null, "id": "f8789f76-36ac-4de1-9982-f650f7ebe48b", "source_name": "malpedia", "url": "https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem" }, { "external_id": null, "id": "c756766b-ffa8-4da4-bae0-3e196186546b", "source_name": "malpedia", "url": "https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/" }, { "external_id": null, "id": "39008d19-95d9-4736-a3ab-6408be474770", "source_name": "malpedia", "url": "https://bluecyber.hashnode.dev/analysis-of-a-clickfix-malware-attack" }, { "external_id": null, "id": "9163fb68-2725-42ad-a2f3-9ee6c3897fc2", "source_name": "malpedia", "url": "https://censys.com/a-beginners-guide-to-hunting-open-directories/" }, { "external_id": null, "id": "3de11371-3ec9-4dbe-b23c-3ab3fb1d9ab0", "source_name": "malpedia", "url": "https://censys.com/tracking-vidar-infrastructure/" }, { "external_id": null, "id": "00de0b28-9da7-44d3-b20a-f0c6bc4062fd", "source_name": "malpedia", "url": "https://cert.pl/en/posts/2021/10/vidar-campaign/" }, { "external_id": null, "id": "2ae1aaed-34f7-4a1d-8c8d-34453d77013b", "source_name": "malpedia", "url": "https://community.emergingthreats.net/t/vidar-stealer-picks-up-steam/271" }, { "external_id": null, "id": "2022b586-d094-4c2f-8dc2-bc3fc1fc2303", "source_name": "malpedia", "url": "https://darktrace.com/blog/vidar-info-stealer-malware-distributed-via-malvertising-on-google" }, { "external_id": null, "id": "e5c2a3cf-9444-49ee-a39d-7edf95f2e567", "source_name": "malpedia", "url": "https://docs.google.com/spreadsheets/d/1nx42rdMdkCrvlmACDi3CHseyG87iSV1Y6rGZYq_-oDk" }, { "external_id": null, "id": "3e140f7e-7832-45f8-9303-fed8a0be9c7d", "source_name": "malpedia", "url": "https://eln0ty.github.io/malware%20analysis/vidar/" }, { "external_id": null, "id": "41c270fd-fdea-4e41-bccc-592f6d03d029", "source_name": "malpedia", "url": "https://embee-research.ghost.io/ghidra-basics-identifying-and-decoding-encrypted-strings/" }, { "external_id": null, "id": "eec510f9-1d6a-4161-a5b6-4230aaea09ee", "source_name": "malpedia", "url": "https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/" }, { "external_id": null, "id": "cd7046ef-4682-40f8-9303-02af670db56e", "source_name": "malpedia", "url": "https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-vidar-2c0a62a73087" }, { "external_id": null, "id": "cc815ae2-b2c9-4f83-90f1-b7da62776dcb", "source_name": "malpedia", "url": "https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf" }, { "external_id": null, "id": "a3d1e275-49f9-4c17-bb2e-4a5a29bff402", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "f2474ac9-4f53-465f-91da-481f5f40d74e", "source_name": "malpedia", "url": "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf" }, { "external_id": null, "id": "45cc5f0d-297f-4ea5-9a23-b0840be23a23", "source_name": "malpedia", "url": "https://insights.loaderinsight.agency/posts/vidar-build-id-correlation/" }, { "external_id": null, "id": "4ad0988b-8644-42e1-973b-fb6ca298277f", "source_name": "malpedia", "url": "https://intel471.com/blog/privateloader-malware" }, { "external_id": null, "id": "1721fa81-5f88-4f65-bfd2-1c146f74ae36", "source_name": "malpedia", "url": "https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468" }, { "external_id": null, "id": "6ab5165a-b028-49ca-9beb-adf794aef6b7", "source_name": "malpedia", "url": "https://isc.sans.edu/diary/rss/28468" }, { "external_id": null, "id": "d20a0fbb-e7b3-44cf-9a33-d733d87af3e5", "source_name": "malpedia", "url": "https://ke-la.com/information-stealers-a-new-landscape/" }, { "external_id": null, "id": "651c601f-90ba-4f7c-885b-e9dbbc695436", "source_name": "malpedia", "url": "https://kienmanowar.wordpress.com/2022/12/17/quicknote-vidarstealer-analysis/" }, { "external_id": null, "id": "5d20e3ed-cd26-446d-a352-d18cee48c6e0", "source_name": "malpedia", "url": "https://m4lcode.github.io/malware%20analysis/vidar/" }, { "external_id": null, "id": "9a321d90-7223-4556-afa2-c3d7c26dfdee", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar" }, { "external_id": null, "id": "3f18b077-9a47-478b-8c14-c6e78239042e", "source_name": "malpedia", "url": "https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145" }, { "external_id": null, "id": "40852be7-93a6-4071-b802-ea81ffcbabd7", "source_name": "malpedia", "url": "https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed" }, { "external_id": null, "id": "f87098ea-982e-4ca3-91ff-a85acccd6b1e", "source_name": "malpedia", "url": "https://medium.com/s2wlab/w1-feb-en-story-of-the-week-stealers-on-the-darkweb-49945a31601d" }, { "external_id": null, "id": "ff6d34bd-9f69-4f64-803a-edf92e77c59a", "source_name": "malpedia", "url": "https://mrtiepolo.medium.com/operation-turb00-analyzing-and-hunting-a-vidar-campaign-b45481d8cd74" }, { "external_id": null, "id": "88962bed-f49a-4cc0-84ea-5a468d434674", "source_name": "malpedia", "url": "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/" }, { "external_id": null, "id": "37052f99-f620-4f03-9522-299e4addcf20", "source_name": "malpedia", "url": "https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/" }, { "external_id": null, "id": "f702625e-9cff-4fd3-ba4e-9fde402d4f1f", "source_name": "malpedia", "url": "https://socprime.com/blog/somnia-malware-detection-uac-0118-aka-frwl-launches-cyber-attacks-against-organizations-in-ukraine-using-enhanced-malware-strains/" }, { "external_id": null, "id": "51f93c5a-018f-44e5-9f4b-2655929acdd6", "source_name": "malpedia", "url": "https://tccontre.blogspot.com/2019/03/infor-stealer-vidar-trojanspy-analysis.html" }, { "external_id": null, "id": "436e87a6-ae77-4932-8cad-53b5c3781f4c", "source_name": "malpedia", "url": "https://therecord.media/microsoft-disrupts-fox-tempest-malware-signing-service" }, { "external_id": null, "id": "599fed37-d621-4b4e-80ea-f873b62dcb22", "source_name": "malpedia", "url": "https://threatpost.com/microsoft-help-files-vidar-malware/179078/" }, { "external_id": null, "id": "c09edf0b-a523-45b0-b3eb-aa5685db8db2", "source_name": "malpedia", "url": "https://twitter.com/GroupIB_GIB/status/1570821174736850945" }, { "external_id": null, "id": "1c4671d7-f555-4c4b-9518-f8dc84c12d79", "source_name": "malpedia", "url": "https://twitter.com/sisoma2/status/1409816282065743872" }, { "external_id": null, "id": "28e9cc9b-7162-46c4-8fc2-b217af969b91", "source_name": "malpedia", "url": "https://viuleeenz.github.io/posts/2023/10/vidar-payload-inspection-with-static-analysis/" }, { "external_id": null, "id": "fdd5b398-dd30-4b4a-8a37-d72fa7fd5259", "source_name": "malpedia", "url": "https://www.aryaka.com/docs/reports/vidar-infostealer-in-action.pdf" }, { "external_id": null, "id": "b7f61ecd-f15f-4b86-b0a4-430a3d63d509", "source_name": "malpedia", "url": "https://www.bleepingcomputer.com/news/security/fake-pixelmon-nft-site-infects-you-with-password-stealing-malware/" }, { "external_id": null, "id": "eb53b48c-85bb-4da8-a13f-6be517163fed", "source_name": "malpedia", "url": "https://www.bleepingcomputer.com/news/security/gandcrab-operators-use-vidar-infostealer-as-a-forerunner/" }, { "external_id": null, "id": "144a11f1-092e-4ea9-a743-75eb0007a2af", "source_name": "malpedia", "url": "https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf" }, { "external_id": null, "id": "e87c6fee-2b0a-4d3a-88ca-d67bafb7ed27", "source_name": "malpedia", "url": "https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware" }, { "external_id": null, "id": "b19787e9-2200-4f14-9844-e3622b90c19b", "source_name": "malpedia", "url": "https://www.csoonline.com/article/3654849/microsoft-help-files-repurposed-to-contain-vidar-malware-in-new-campaign.html" }, { "external_id": null, "id": "8d96a3c6-3b3d-4465-a166-0081f5d49646", "source_name": "malpedia", "url": "https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware" }, { "external_id": null, "id": "31f78e34-0cba-4b4d-bce0-934b4688f9a5", "source_name": "malpedia", "url": "https://www.cynet.com/blog/cyops-lighthouse-vidar-stealer/" }, { "external_id": null, "id": "adf1ff42-2277-4c05-9f78-d494d454d2fc", "source_name": "malpedia", "url": "https://www.derp.ca/research/vidar-go-sandbox-dead-drop/" }, { "external_id": null, "id": "7812be83-4306-4338-add7-17d21fe13f90", "source_name": "malpedia", "url": "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks" }, { "external_id": null, "id": "80a643a1-b36d-4794-89ef-f6dc0ad08d3d", "source_name": "malpedia", "url": "https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif" }, { "external_id": null, "id": "67cf60d1-24de-4e6e-8b06-a14c3ac2dc6b", "source_name": "malpedia", "url": "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader" }, { "external_id": null, "id": "5937af53-7bcd-4b12-8caf-65d031c525af", "source_name": "malpedia", "url": "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-vidar-stealer" }, { "external_id": null, "id": "f0776771-b7ac-40d9-a2fb-dc35b049a195", "source_name": "malpedia", "url": "https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper" }, { "external_id": null, "id": "9a123075-ec9d-4bbf-85d6-c6f2b956baec", "source_name": "malpedia", "url": "https://www.gatewatcher.com/lab/utilisation-de-faux-profils-steam-vidar-prend-les-commandes/" }, { "external_id": null, "id": "2166b1bf-fd3f-4c82-a780-9b1ff92bdc13", "source_name": "malpedia", "url": "https://www.gendigital.com/blog/insights/research/inside-vidar-abe-bypass" }, { "external_id": null, "id": "07f17402-3042-46aa-bca5-fb9c5e1b197d", "source_name": "malpedia", "url": "https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer" }, { "external_id": null, "id": "016447cd-3bd9-4743-ba97-c2e1fe1968d0", "source_name": "malpedia", "url": "https://www.kroll.com/en/insights/publications/cyber/threat-actors-google-ads-deploy-vidar-stealer" }, { "external_id": null, "id": "2510035d-f8c2-41fc-8f87-10bdb1bb66df", "source_name": "malpedia", "url": "https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families.pdf" }, { "external_id": null, "id": "1e5f05bb-9433-410d-a9b3-4bfbb4456c5c", "source_name": "malpedia", "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf" }, { "external_id": null, "id": "32da9166-004f-4b67-824a-b7bd88d6389e", "source_name": "malpedia", "url": "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/" }, { "external_id": null, "id": "30391646-1f3d-4dbc-80d2-eb785b9ee705", "source_name": "malpedia", "url": "https://www.team-cymru.com/post/darth-vidar-the-aesir-strike-back" }, { "external_id": null, "id": "f298c706-5815-4e7b-b43a-14d03c673117", "source_name": "malpedia", "url": "https://www.team-cymru.com/post/darth-vidar-the-dark-side-of-evolving-threat-infrastructure" }, { "external_id": null, "id": "ce6bac6d-df0e-46a7-a904-110fa0be1ddc", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html" }, { "external_id": null, "id": "1c3915de-b531-4093-808a-6375e9e610c3", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/e/tiktok-videos-infostealers.html" }, { "external_id": null, "id": "22c0e0b7-f2de-4f07-bcd7-0097042715d6", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html" }, { "external_id": null, "id": "867cc050-4804-4c9d-b78d-12dc8af83e0e", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/26/d/weaponizing-trust-claude-code-lures-and-github-release-payloads.html" }, { "external_id": null, "id": "e14c0692-55e1-4b8e-99a9-050b3d1598fa", "source_name": "malpedia", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/" }, { "external_id": null, "id": "9bb7bd95-75d4-41f7-9861-c65b553f24d4", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation" }, { "external_id": null, "id": "3a79d954-536f-42ea-ba34-9453a5d4dcc5", "source_name": "malpedia", "url": "https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing" }, { "external_id": null, "id": "f23130ab-88c4-407b-843e-9ef2b0cf7fc6", "source_name": "malpedia", "url": "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/" }, { "external_id": null, "id": "adbe0b48-4d08-42c2-af25-a3943badf5c2", "source_name": "malpedia", "url": "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-2/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "malware--7411d5ab-6535-5874-b5e2-43fe642028a5", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:25.529Z", "updated_at": "2026-09-26T18:54:25.892Z" }, "description_available": false, "entity_type": "StixFile", "id": "d393e4fe-805d-4eae-88d6-0528aff37489", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--649e5fbc-cfb7-56a3-b4d8-202dc84c4dd0", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.595Z", "created_at": "2026-09-26T18:54:30.436Z", "modified": "2026-09-26T18:54:44.792Z", "updated_at": "2026-09-26T18:54:44.792Z" }, "description_available": false, "entity_type": "Indicator", "id": "d628d192-0961-470a-b5e6-ad8b9488908b", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--69ca1747-17f0-58f0-be86-19c5081004d6", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:24.628Z", "updated_at": "2026-09-26T18:54:24.974Z" }, "description_available": false, "entity_type": "StixFile", "id": "e3607c43-ea91-4f9b-8b3f-e86c3295a7aa", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--4d29c3c0-b5ed-5776-8f7e-271914f15a46", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.592Z", "created_at": "2026-09-26T18:54:30.425Z", "modified": "2026-09-26T18:54:42.119Z", "updated_at": "2026-09-26T18:54:42.119Z" }, "description_available": false, "entity_type": "Indicator", "id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "indicator--459505bb-ea20-51a8-ae78-65efcc207509", "type": "Indicator" }, { "__typename": "AttackPattern", "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "entity_type": "Attack-Pattern", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "labels": [], "lang": "en", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "attack-pattern--be8b782f-8ecd-5dd6-817b-9a97173465ca", "type": "AttackPattern" }, { "__typename": "Malware", "aliases": [ "win.remus" ], "attributes": { "is_family": false, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-04-09T20:32:32.419Z", "created_at": "2026-04-09T23:38:42.871Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-09T09:24:19.530Z", "updated_at": "2026-10-09T09:24:19.530Z" }, "description_available": true, "entity_type": "Malware", "id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "is_inferred": false, "labels": [ "botnet_cc", "none" ], "lang": "en", "name": "Remus", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "ce02fb10-84f3-492c-9e33-56b2c8dd3e27", "source_name": "alien-vault", "url": "https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus" }, { "external_id": null, "id": "a4e4dd5c-23ea-4b7b-80c7-3b06282a2110", "source_name": "malpedia", "url": "https://aachum.github.io/website/remus_analysis" }, { "external_id": null, "id": "1ec444c6-7334-42c4-80b4-de3b26c50206", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.remus" }, { "external_id": null, "id": "4a00c9f8-927e-4cf1-a7ac-e2986d1a3902", "source_name": "malpedia", "url": "https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/" }, { "external_id": null, "id": "06a470bb-2417-4a03-b65a-e733310dcd19", "source_name": "malpedia", "url": "https://t0asts.com/meccha-chameleon" }, { "external_id": null, "id": "79b9d64f-320f-4e14-becd-483c8c59cc8f", "source_name": "malpedia", "url": "https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "malware--501abf4b-141e-550c-a572-818dac23214c", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:24.435Z", "updated_at": "2026-09-26T18:54:24.820Z" }, "description_available": false, "entity_type": "StixFile", "id": "f486bfad-59ed-43b8-a426-05709f9c4a86", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--2372fb92-f183-5fa5-adfb-ef64987c8a93", "type": "StixFile" }, { "__typename": "Country", "aliases": [ "IO", "IOT" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:35:46.139Z", "modified": "2026-03-05T15:26:02.116Z", "updated_at": "2026-03-05T15:26:02.116Z" }, "description_available": false, "entity_type": "Country", "id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "is_inferred": false, "labels": [], "lang": "en", "name": "British Indian Ocean Territory", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "location--0d38b30d-6a67-566c-a32f-bbb91751d7d8", "type": "Country" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:54:23.221Z", "updated_at": "2026-09-26T18:54:23.657Z" }, "description_available": false, "entity_type": "StixFile", "id": "fd9d7f6d-6cd7-4d7f-8388-2152298e576e", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "file--d166b0e1-0e3c-5ddb-8af3-b8e8febbb46d", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.711Z", "created_at": "2026-09-26T18:59:30.096Z", "modified": "2026-09-26T18:59:30.329Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:30.329Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_name": null, "from_type": "Indicator", "id": "03357191-9cc8-47e2-b502-189c70a22620", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--3c57eaf8-511b-56d9-bb25-9f6afc55e4ef", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.578Z", "created_at": "2026-09-26T18:54:42.141Z", "modified": "2026-09-26T18:54:43.190Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:54:43.190Z" }, "description_available": false, "entity_type": "targets", "fromId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_name": "ACRStealer", "from_type": "Malware", "id": "0955a6a8-c3b6-4a90-b5dc-ef2b7593b0bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--d1dfb755-88fe-5c04-afd7-197fb6915edc", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.598Z", "created_at": "2026-09-26T18:55:31.416Z", "modified": "2026-09-26T18:55:32.861Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:32.861Z" }, "description_available": false, "entity_type": "based-on", "fromId": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_name": null, "from_type": "Indicator", "id": "0958957f-91b0-459a-afbb-07044605d1ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--7843c5cc-55b4-5b38-8978-f67a5a3eb21a", "toId": "f486bfad-59ed-43b8-a426-05709f9c4a86", "to_id": "f486bfad-59ed-43b8-a426-05709f9c4a86", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.788Z", "created_at": "2026-09-26T19:02:08.975Z", "modified": "2026-09-26T19:02:09.258Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:02:09.258Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_name": null, "from_type": "Indicator", "id": "0b5d52f2-7fc0-46ae-832c-56f2d5f5e86f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--8ef334db-7b66-52f4-a71b-0267283c8f34", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.654Z", "created_at": "2026-09-26T18:58:06.684Z", "modified": "2026-09-26T18:58:06.954Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:06.954Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_name": null, "from_type": "Indicator", "id": "10b2b1c7-3caf-4790-8c95-4e64aa605c5a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--8cdefe51-82d1-5c74-96b0-8891feb0eda7", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.625Z", "created_at": "2026-09-26T18:56:01.503Z", "modified": "2026-09-26T18:56:01.925Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:56:01.925Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_name": null, "from_type": "Indicator", "id": "11e2cbeb-3f32-4190-89a3-3612d663fe25", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--27b26643-a7f2-599f-91b4-ebc716b22eed", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.653Z", "created_at": "2026-09-26T18:58:01.379Z", "modified": "2026-09-26T18:58:03.962Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:03.962Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_name": null, "from_type": "Indicator", "id": "12edfba4-822d-41c8-97ed-1d310118177d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--3bda30fe-b026-539f-aa65-cec1a263f05c", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.044Z", "created_at": "2026-01-18T14:39:00.892Z", "modified": "2026-01-18T14:39:01.182Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:01.182Z" }, "description_available": true, "entity_type": "located-at", "fromId": "6926835d-28e0-4787-97c9-699d0375b12b", "from_id": "6926835d-28e0-4787-97c9-699d0375b12b", "from_name": "India", "from_type": "Country", "id": "1943dcbb-b312-436e-873f-c3cef811d6bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--f7bc8131-8473-5cdd-9b6d-660635e5d317", "toId": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_name": "Southern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.682Z", "created_at": "2026-09-26T18:58:46.735Z", "modified": "2026-09-26T18:58:47.066Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:47.066Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_id": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_name": null, "from_type": "Indicator", "id": "1950c2d2-7ab0-4845-8368-7c757b3f66dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--809872f5-da7f-59b2-a780-08333b58a571", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.584Z", "created_at": "2026-09-26T18:55:29.093Z", "modified": "2026-09-26T18:55:29.373Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:29.373Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_name": null, "from_type": "Indicator", "id": "1ab9a4f0-9a57-4a97-9e4f-1b5402a022ae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--ba17ac43-db02-5c97-ae43-3645e1e19896", "toId": "23079917-2b9f-467f-ab29-456bc011fbbf", "to_id": "23079917-2b9f-467f-ab29-456bc011fbbf", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.626Z", "created_at": "2026-09-26T18:56:02.386Z", "modified": "2026-09-26T18:56:02.630Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:56:02.630Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_name": null, "from_type": "Indicator", "id": "2142c477-d129-4c61-b1d0-66989a266411", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--87db0165-02ea-595c-8465-b1272adb1d19", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.741Z", "created_at": "2026-09-26T19:00:21.659Z", "modified": "2026-09-26T19:00:21.910Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:00:21.910Z" }, "description_available": false, "entity_type": "indicates", "fromId": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_name": null, "from_type": "Indicator", "id": "220428cd-0122-4179-802c-cacef25d1cfb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--db2c4a05-7a9a-5354-8bce-a14652ef47a8", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.574Z", "created_at": "2026-09-26T18:54:40.042Z", "modified": "2026-09-26T18:54:40.591Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:54:40.591Z" }, "description_available": false, "entity_type": "targets", "fromId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_name": "Remus", "from_type": "Malware", "id": "25737fc8-44d5-414f-adc3-76ea79019f24", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--c184790a-b496-5e8c-8b09-12da72c74768", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:37:23.973Z", "modified": "2026-01-18T14:37:24.172Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:24.172Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "from_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "from_name": "British Indian Ocean Territory", "from_type": "Country", "id": "2583270a-b17f-4374-9d91-f191ee3f1eb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--1ac96288-b57b-5204-a37b-5e60317969a7", "toId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_name": "Sub-Saharan Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.727Z", "created_at": "2026-09-26T18:59:55.771Z", "modified": "2026-09-26T18:59:56.099Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:56.099Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_name": null, "from_type": "Indicator", "id": "26317fb3-cd54-4df5-b6fc-6ba040b8d699", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--77a3ece5-24c8-5abc-9bad-dda78e0290ec", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.742Z", "created_at": "2026-09-26T19:00:22.699Z", "modified": "2026-09-26T19:00:23.021Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:00:23.021Z" }, "description_available": false, "entity_type": "indicates", "fromId": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_name": null, "from_type": "Indicator", "id": "26ecc26b-59c6-4398-b4ea-b0cb6b9e883d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--613d55c9-4c79-5331-902e-38f81e08b548", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.743Z", "created_at": "2026-09-26T19:00:36.656Z", "modified": "2026-09-26T19:00:37.157Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:00:37.157Z" }, "description_available": false, "entity_type": "indicates", "fromId": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_name": null, "from_type": "Indicator", "id": "2af67ef5-69ca-4230-8de0-d8ea62378645", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--293ff5d1-021c-5b75-8f5f-fb46fbce4f58", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.601Z", "created_at": "2026-09-26T18:55:32.872Z", "modified": "2026-09-26T18:55:33.517Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:33.517Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_name": null, "from_type": "Indicator", "id": "2b0a4f57-60ee-4ab0-add3-6f9ed9139872", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--7c052b44-9c32-5698-a71e-a46105d349da", "toId": "0441b824-dbb6-4b77-a143-1e512dd8ae05", "to_id": "0441b824-dbb6-4b77-a143-1e512dd8ae05", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.667Z", "created_at": "2026-09-26T18:58:22.736Z", "modified": "2026-09-26T18:58:23.123Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:23.123Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_name": null, "from_type": "Indicator", "id": "2c8dbe96-b6a9-46ca-bc99-3ed3f722b88a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--cb595cc9-52fd-56da-abf1-39cb70afc463", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:11.714Z", "created_at": "2026-03-24T16:25:32.650Z", "modified": "2026-03-24T16:25:35.251Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-24T16:25:35.251Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "313e8a06-aff5-4b54-b5b6-1d3cdf31b127", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--df1fb30b-11f0-57a2-b44a-75c9bcdaf84d", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.606Z", "created_at": "2026-09-26T18:55:33.601Z", "modified": "2026-09-26T18:55:34.343Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:34.343Z" }, "description_available": false, "entity_type": "based-on", "fromId": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_name": null, "from_type": "Indicator", "id": "317a702d-d88b-4c91-8982-fc2f27237b2d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--b8b7a89b-7d84-5957-9e82-82145e7c6d6a", "toId": "8a2da631-c2a5-4ff3-9131-daee7696c8c3", "to_id": "8a2da631-c2a5-4ff3-9131-daee7696c8c3", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:18:14.122Z", "created_at": "2026-04-25T00:38:20.225Z", "modified": "2026-04-25T00:38:21.265Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-25T00:38:21.265Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "334a86e6-dc29-406b-84c2-e3261979d682", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--6850c2c3-7162-5383-97d2-3f3dc4caaaf6", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:23:11.579Z", "created_at": "2026-08-09T14:42:15.545Z", "modified": "2026-08-09T14:42:18.178Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-09T14:42:18.178Z" }, "description_available": false, "entity_type": "uses", "fromId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_name": "Remus", "from_type": "Malware", "id": "387c6108-58c0-4c8c-8706-1432f9148fb6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--66c007a9-9b82-5a4a-82d3-3d96c16caab4", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.679Z", "created_at": "2026-09-26T18:58:42.576Z", "modified": "2026-09-26T18:58:43.152Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:43.152Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_name": null, "from_type": "Indicator", "id": "3b9e1158-099c-441d-831d-8a26b1da20fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--79f76bc1-77ac-52dd-8453-90e1e3411762", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.571Z", "created_at": "2026-09-26T18:54:36.790Z", "modified": "2026-09-26T18:54:37.456Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:54:37.456Z" }, "description_available": false, "entity_type": "targets", "fromId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_name": "ACRStealer", "from_type": "Malware", "id": "3fcf20bc-5020-4ca1-ab30-e56b375c7f2b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--bd1cbb07-4f94-5637-b440-b47543b8ca9c", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.712Z", "created_at": "2026-09-26T18:59:35.400Z", "modified": "2026-09-26T18:59:35.834Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:35.834Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_name": null, "from_type": "Indicator", "id": "4ad23e1b-71a1-467b-9856-747d10680751", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--c81f706c-e4bb-53cf-933e-e5c6b6a133cd", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.613Z", "created_at": "2026-09-26T18:55:42.965Z", "modified": "2026-09-26T18:55:44.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:44.305Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_name": null, "from_type": "Indicator", "id": "5014428c-d730-4716-ab3e-188ff4b7e9ae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--174d9827-8c18-5291-87c4-938f607d2a59", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.625Z", "created_at": "2026-09-26T18:56:01.566Z", "modified": "2026-09-26T18:56:02.240Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:56:02.240Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_name": null, "from_type": "Indicator", "id": "54824c2e-e2d8-4b6b-b07d-089c4b7cb937", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--e0ced84d-e80f-5870-bc26-ed9e77cd64dd", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.626Z", "created_at": "2026-09-26T18:56:03.596Z", "modified": "2026-09-26T18:56:03.790Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:56:03.790Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_name": null, "from_type": "Indicator", "id": "570ae172-2979-4a99-8c04-54e8f0c3c097", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--28a11998-1d4f-539a-abdd-65a35c417478", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.612Z", "created_at": "2026-09-26T18:55:34.789Z", "modified": "2026-09-26T18:55:35.141Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:35.141Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_name": null, "from_type": "Indicator", "id": "59b2da9d-ce5d-4709-b401-c54015e246fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--938e51d1-3cc7-56b9-89a3-a7b802f4bf7e", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.757Z", "created_at": "2026-09-26T19:01:17.406Z", "modified": "2026-09-26T19:01:18.350Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:18.350Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_name": null, "from_type": "Indicator", "id": "5a340ef8-ce85-461d-bf58-24e2a12925d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--b3a8f272-ee19-5b06-9792-825717ef720e", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.652Z", "created_at": "2026-09-26T18:58:00.027Z", "modified": "2026-09-26T18:58:00.489Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:00.489Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_name": null, "from_type": "Indicator", "id": "5c9c1f04-504d-415b-b9a7-824f47e90e57", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--1a435ffe-78bc-5bc5-ad66-c4b6818d2b61", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.591Z", "created_at": "2026-09-26T18:55:30.472Z", "modified": "2026-09-26T18:55:30.827Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:30.827Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_name": null, "from_type": "Indicator", "id": "5dee38ac-8d3c-462c-a8d6-6e47bcfef0eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--0c80e214-e6cd-5a47-a9ce-8727784eb274", "toId": "fd9d7f6d-6cd7-4d7f-8388-2152298e576e", "to_id": "fd9d7f6d-6cd7-4d7f-8388-2152298e576e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.586Z", "created_at": "2026-09-26T18:55:29.672Z", "modified": "2026-09-26T18:55:30.004Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:30.004Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_name": null, "from_type": "Indicator", "id": "656f5637-f616-4b91-b739-d204a02292ac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--a84efaa2-ca76-5c9c-bc78-36b645d2844a", "toId": "21747585-e7f5-472d-a4be-4d1746195f5a", "to_id": "21747585-e7f5-472d-a4be-4d1746195f5a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.713Z", "created_at": "2026-09-26T18:59:33.974Z", "modified": "2026-09-26T18:59:34.474Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:34.474Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_name": null, "from_type": "Indicator", "id": "6760ef2a-5a9d-4beb-be47-46300d05d5db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--74d5441f-6a35-52db-87e6-d5b89cf3b095", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T22:01:51.887Z", "created_at": "2026-04-03T20:20:42.572Z", "modified": "2026-04-03T20:20:43.294Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-03T20:20:43.294Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "6c9bd9fb-3961-4363-8ae2-7c7cea968f01", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--1328b381-c227-5da7-88ca-e3ad8351cf61", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.743Z", "created_at": "2026-09-26T19:00:24.654Z", "modified": "2026-09-26T19:00:27.690Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:00:27.690Z" }, "description_available": false, "entity_type": "indicates", "fromId": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_name": null, "from_type": "Indicator", "id": "6e419093-65b2-4302-9afc-22f507be74eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--cdd82666-6fe8-5a50-a7f7-22360d5df00b", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.665Z", "created_at": "2026-09-26T18:58:21.451Z", "modified": "2026-09-26T18:58:21.714Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:21.714Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_name": null, "from_type": "Indicator", "id": "7346bad9-2cce-4c38-a4a7-12ecd75b32f6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--a995bf53-d0f4-54c8-a287-24622d170ccb", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.775Z", "created_at": "2026-09-26T19:01:49.465Z", "modified": "2026-09-26T19:01:49.723Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:49.723Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_name": null, "from_type": "Indicator", "id": "73c06ae4-fc22-4a43-b6b7-cd94f2d4574e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--c5b32ac9-588b-55d9-8335-9ef860a07348", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.726Z", "created_at": "2026-09-26T18:59:55.290Z", "modified": "2026-09-26T18:59:55.533Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:55.533Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_name": null, "from_type": "Indicator", "id": "763dcaf9-68b5-4711-994d-88a9ea168142", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--c8bfbbc8-de69-5960-b793-6b71137ebcdb", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.775Z", "created_at": "2026-09-26T19:01:54.937Z", "modified": "2026-09-26T19:01:55.406Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:55.406Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_name": null, "from_type": "Indicator", "id": "79f280b9-3015-488c-b43c-c422f096ce58", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--469f469b-1e90-50d6-ad1d-0e50e7828260", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.534Z", "created_at": "2026-03-14T10:20:12.932Z", "modified": "2026-03-14T10:20:13.645Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:20:13.645Z" }, "description_available": false, "entity_type": "uses", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "7abf4137-85af-46e1-b19f-2a2206a91b82", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--8b4bb00c-398a-533a-a602-9120ff997b81", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:23:11.594Z", "created_at": "2026-08-09T14:42:59.462Z", "modified": "2026-08-09T14:43:00.290Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-09T14:43:00.290Z" }, "description_available": false, "entity_type": "uses", "fromId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_name": "ACRStealer", "from_type": "Malware", "id": "7b36a4a0-635f-474c-9a50-31e9034e96af", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--457cf861-6e9a-5470-860f-ecdad5ec4795", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.759Z", "created_at": "2026-09-26T19:01:20.310Z", "modified": "2026-09-26T19:01:20.862Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:20.862Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_name": null, "from_type": "Indicator", "id": "7ecfcfee-b3de-4567-bf80-01671bb9488d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--1139a79c-f40f-5cfb-976e-a4a3d3cdbd18", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.589Z", "created_at": "2026-09-26T18:55:30.406Z", "modified": "2026-09-26T18:55:30.608Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:30.608Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_name": null, "from_type": "Indicator", "id": "7f1cb401-9996-407d-aad0-cfd44ccd678b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--045a2c49-08e6-5a7c-a559-2ca48eaee6c3", "toId": "cd8bd88d-ae6b-489d-8a4b-579aa845101e", "to_id": "cd8bd88d-ae6b-489d-8a4b-579aa845101e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.758Z", "created_at": "2026-09-26T19:01:22.366Z", "modified": "2026-09-26T19:01:22.601Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:22.601Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_name": null, "from_type": "Indicator", "id": "7fa50607-21e3-4c47-97d0-35b57bf0c35a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--54d05125-7302-5448-8ef1-6d6f5fcf61d8", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.758Z", "created_at": "2026-09-26T19:01:18.750Z", "modified": "2026-09-26T19:01:18.933Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:18.933Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_name": null, "from_type": "Indicator", "id": "806c8243-fe46-40b9-8a95-ddbcce38ab62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--127e8961-c149-52ca-82bb-990d254b1287", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-07-11T19:31:59.933Z", "created_at": "2026-07-12T02:33:29.801Z", "modified": "2026-07-12T02:33:30.058Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-07-12T02:33:30.058Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "81d450fe-b80a-487e-afe5-e2a6c23f8237", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--4c03a6c1-5029-5a38-a9c9-7a93d96a126c", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.725Z", "created_at": "2026-09-26T18:59:55.538Z", "modified": "2026-09-26T18:59:55.747Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:55.747Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_name": null, "from_type": "Indicator", "id": "84730a17-65fd-4f9f-94c3-86430e548450", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--98b5c9c0-a463-5a92-9203-208ec9961fe1", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.680Z", "created_at": "2026-09-26T18:58:43.460Z", "modified": "2026-09-26T18:58:43.679Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:43.679Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_id": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_name": null, "from_type": "Indicator", "id": "8595762b-8f3b-4f80-be6b-74c90149dd13", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--d87355d1-a6f4-5b1d-9101-6ce3dcbbfbb2", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.578Z", "created_at": "2026-09-26T18:54:41.385Z", "modified": "2026-09-26T18:54:41.790Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:54:41.790Z" }, "description_available": false, "entity_type": "targets", "fromId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_name": "ACRStealer", "from_type": "Malware", "id": "8844df12-008c-4db4-85ed-b6ccf86a98f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--081664dc-58cc-558d-be08-f72ed4a3869b", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.640Z", "created_at": "2026-09-26T18:57:43.088Z", "modified": "2026-09-26T18:57:43.566Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:57:43.566Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_name": null, "from_type": "Indicator", "id": "8861ca5b-a017-4f60-ac25-163394ee502e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--f5200556-2e1e-5e47-8c89-c897f7885f61", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.776Z", "created_at": "2026-09-26T19:01:50.152Z", "modified": "2026-09-26T19:01:51.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:51.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_name": null, "from_type": "Indicator", "id": "8b0d5c88-edcf-4491-b83b-8d12611b13c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--bcdf0802-a31a-5d1f-9166-f40b4d7b905a", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.613Z", "created_at": "2026-09-26T18:55:49.913Z", "modified": "2026-09-26T18:55:50.458Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:50.458Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_name": null, "from_type": "Indicator", "id": "8e099215-e205-4cb8-8d54-634f98ec35ad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--261aca12-a7dc-5a9a-aec6-6230c20f028c", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.611Z", "created_at": "2026-09-26T18:55:34.681Z", "modified": "2026-09-26T18:55:34.956Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:34.956Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_name": null, "from_type": "Indicator", "id": "99ab6aaa-08ee-4a6a-807f-0f78d0ae8793", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--050026b3-62a8-5698-81b7-e061769bb916", "toId": "d393e4fe-805d-4eae-88d6-0528aff37489", "to_id": "d393e4fe-805d-4eae-88d6-0528aff37489", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.569Z", "created_at": "2026-09-26T18:54:38.896Z", "modified": "2026-09-26T18:54:39.650Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:54:39.650Z" }, "description_available": false, "entity_type": "targets", "fromId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_name": "Remus", "from_type": "Malware", "id": "9a0b956e-ab31-4916-8f86-6cd01405a20d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--628ae1d2-7f1e-5c29-ab6c-1624a051cf57", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.596Z", "created_at": "2026-09-26T18:55:31.407Z", "modified": "2026-09-26T18:55:32.860Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:32.860Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_id": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_name": null, "from_type": "Indicator", "id": "9f8b3e89-24dd-4e1a-a3c3-2df30a167d3d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--97e8bcc2-4b25-51e1-a031-0bc0d0aa662d", "toId": "106db67e-675c-49a2-97f3-c0db143cb35e", "to_id": "106db67e-675c-49a2-97f3-c0db143cb35e", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.652Z", "created_at": "2026-09-26T18:58:00.747Z", "modified": "2026-09-26T18:58:01.083Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:01.083Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_name": null, "from_type": "Indicator", "id": "a30bb434-838f-4ce4-8c19-f7f09f1c9e24", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--65607ee0-7d95-55e0-944b-09164c04b3a7", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.774Z", "created_at": "2026-09-26T19:01:49.025Z", "modified": "2026-09-26T19:01:49.222Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:49.222Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "from_name": null, "from_type": "Indicator", "id": "a5986891-a7d1-46a7-b119-362504432d3b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--b4fb69f4-cf07-59cd-8f4f-eb7a735f0c40", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.725Z", "created_at": "2026-09-26T18:59:54.571Z", "modified": "2026-09-26T18:59:54.783Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:54.783Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_name": null, "from_type": "Indicator", "id": "a8b952d3-6206-47c0-9af6-3f949d11a70d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--ecb83926-c896-5092-ad6f-5bd0a33100c6", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.697Z", "created_at": "2026-09-26T18:59:21.349Z", "modified": "2026-09-26T18:59:21.561Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:21.561Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_name": null, "from_type": "Indicator", "id": "aa4b1dc5-b06a-4f11-bcb3-bacb98cc64dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--c705fe35-b132-58f4-bcd4-ac0bf8180f8c", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.638Z", "created_at": "2026-09-26T18:57:05.759Z", "modified": "2026-09-26T18:57:08.680Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:57:08.680Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_name": null, "from_type": "Indicator", "id": "aeb61bd8-30e4-415f-871d-bde74a567fe1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--07bc01b7-3582-5bfa-88d3-6b023227110e", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.774Z", "created_at": "2026-09-26T19:01:48.474Z", "modified": "2026-09-26T19:01:48.806Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:48.806Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_name": null, "from_type": "Indicator", "id": "b2bb86b8-832b-4436-af44-5b2093338513", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--40c22883-6d70-5d54-81ab-83937348c477", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.696Z", "created_at": "2026-09-26T18:59:08.176Z", "modified": "2026-09-26T18:59:08.700Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:08.700Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_name": null, "from_type": "Indicator", "id": "b4741668-a4f0-4b8e-b5b1-fca32925fc5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--82b0a8e4-bb9f-575e-8981-f5f765df5768", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.667Z", "created_at": "2026-09-26T18:58:24.953Z", "modified": "2026-09-26T18:58:27.076Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:27.076Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_name": null, "from_type": "Indicator", "id": "b5f55d70-bccf-4e4f-8293-100e5f180860", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--fb1d6c2d-f8b8-5796-9cda-dacd28804eb1", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.639Z", "created_at": "2026-09-26T18:57:19.299Z", "modified": "2026-09-26T18:57:22.832Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:57:22.832Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_name": null, "from_type": "Indicator", "id": "b7cf5c21-96d7-46de-b6a7-ea3a158bc42d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--a7fde0ae-8119-5ba0-8632-e6e13f52bc00", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.603Z", "created_at": "2026-09-26T18:55:33.599Z", "modified": "2026-09-26T18:55:34.233Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:34.233Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_name": null, "from_type": "Indicator", "id": "b8c0504a-15a1-4e54-b82b-212956c5431f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--64d3f5ed-bb7b-5eb7-b318-fc35ced8a7ce", "toId": "e3607c43-ea91-4f9b-8b3f-e86c3295a7aa", "to_id": "e3607c43-ea91-4f9b-8b3f-e86c3295a7aa", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.609Z", "created_at": "2026-09-26T18:55:33.965Z", "modified": "2026-09-26T18:55:34.483Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:34.483Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "from_name": null, "from_type": "Indicator", "id": "ba951f5a-afdb-4af7-8159-37835a7d7ce0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--f0955a40-c4ea-5f32-bfcc-1bd62aed6f7b", "toId": "7c7e7bec-7319-476c-95df-39cf14affd0a", "to_id": "7c7e7bec-7319-476c-95df-39cf14affd0a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.640Z", "created_at": "2026-09-26T18:57:39.431Z", "modified": "2026-09-26T18:57:42.772Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:57:42.772Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_name": null, "from_type": "Indicator", "id": "bbe26263-604e-4bf9-80e5-ef55acf72ad0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--748b2c3b-c07b-57a7-9bf2-28425ffbf00d", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.575Z", "created_at": "2026-09-26T18:54:44.534Z", "modified": "2026-09-26T18:54:45.963Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:54:45.963Z" }, "description_available": false, "entity_type": "targets", "fromId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_name": "Remus", "from_type": "Malware", "id": "bdbf4592-996b-4d75-8a74-107a372107e2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--2f080a15-510a-5431-a2b9-de8daddfd851", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:54:44.601Z", "created_at": "2026-03-04T09:23:01.029Z", "modified": "2026-03-04T09:23:01.276Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-04T09:23:01.276Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "bf2144f5-e630-4006-be00-0e09c2901f14", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--152d071c-9b7e-5a89-9830-cd1b184c6763", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.666Z", "created_at": "2026-09-26T18:58:29.940Z", "modified": "2026-09-26T18:58:30.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:30.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_name": null, "from_type": "Indicator", "id": "bfb83ab2-0f70-4388-a8ad-e8ecd68a6c77", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--112520ed-27f5-5677-94e4-2df09b57df0d", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.712Z", "created_at": "2026-09-26T18:59:31.236Z", "modified": "2026-09-26T18:59:32.585Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:32.585Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "from_name": null, "from_type": "Indicator", "id": "c7cb355e-134e-4038-a14a-3c24e81fef01", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--801c26fa-a39a-5eb3-9587-c4f55226c128", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.741Z", "created_at": "2026-09-26T19:00:23.048Z", "modified": "2026-09-26T19:00:23.493Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:00:23.493Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_name": null, "from_type": "Indicator", "id": "cc42f559-595d-48d3-a573-6efaf3618fcd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--312d5b73-b839-5a31-9e8d-ac17d0731240", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.697Z", "created_at": "2026-09-26T18:59:09.200Z", "modified": "2026-09-26T18:59:09.700Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:09.700Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_name": null, "from_type": "Indicator", "id": "d0e4621c-e24f-446a-8db4-487c80bb32bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--b24acae5-3969-5450-999c-c17fdb10b5e4", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T17:58:00.420Z", "created_at": "2026-02-22T23:47:10.044Z", "modified": "2026-02-22T23:47:13.576Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-22T23:47:13.576Z" }, "description_available": false, "entity_type": "targets", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "d1dd24b0-1667-40de-b45b-13d101696bed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--621c5cd6-dbc3-5cac-a518-1c5dd8f16a64", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:37:23.360Z", "modified": "2026-01-18T14:37:23.561Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:23.561Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "from_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "from_name": "Sub-Saharan Africa", "from_type": "Region", "id": "d5a551bf-8e48-4170-8e04-6f35bc3ddd9c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--2229f684-8d2e-5463-a181-1e9500b61b26", "toId": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "to_id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "to_name": "Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.695Z", "created_at": "2026-09-26T18:59:05.405Z", "modified": "2026-09-26T18:59:05.792Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:05.792Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_id": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_name": null, "from_type": "Indicator", "id": "da611403-cd4d-4826-b3bb-bb60a43110ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--06b6518e-114e-5bf2-a954-7f8fed21f5f2", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:11.711Z", "created_at": "2026-03-24T16:25:43.775Z", "modified": "2026-03-24T16:25:50.617Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-24T16:25:50.617Z" }, "description_available": false, "entity_type": "targets", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "da82b3dd-ec4f-431c-9402-8292031eab78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--8e69ea14-f672-5455-b2ad-d895c3823d5f", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.639Z", "created_at": "2026-09-26T18:57:30.577Z", "modified": "2026-09-26T18:57:34.378Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:57:34.378Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "from_name": null, "from_type": "Indicator", "id": "dd56f3ed-5f37-49a4-98da-d6d6d42b9f72", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--74fca740-a2eb-5ee7-84fb-0aa9ba137f56", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.695Z", "created_at": "2026-09-26T18:59:06.218Z", "modified": "2026-09-26T18:59:06.752Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:06.752Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_name": null, "from_type": "Indicator", "id": "ddeab759-8238-4401-ae18-776aed9f3dd8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--65ff5560-150c-52cd-8bc1-7947cbf01406", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.680Z", "created_at": "2026-09-26T18:58:45.622Z", "modified": "2026-09-26T18:58:46.210Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:46.210Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_id": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_name": null, "from_type": "Indicator", "id": "ec50ba52-a5c4-451a-962b-3d6d1408b191", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--0669853b-1f53-595b-9b49-a59fb33187c9", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.627Z", "created_at": "2026-09-26T18:56:02.955Z", "modified": "2026-09-26T18:56:03.355Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:56:03.355Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "from_name": null, "from_type": "Indicator", "id": "f00f0dcc-6c5b-4375-ad11-7bb9916704b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--1f180e54-36d5-5b70-bd3d-b19f7b39cf39", "toId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "to_name": "ACRStealer", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.726Z", "created_at": "2026-09-26T19:00:07.178Z", "modified": "2026-09-26T19:00:07.912Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:00:07.912Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "from_name": null, "from_type": "Indicator", "id": "f1c21c1c-9e41-40fb-b652-22e0ec462bf0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--e67315b6-a836-5091-bd3d-7bc826817447", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.666Z", "created_at": "2026-09-26T18:58:22.033Z", "modified": "2026-09-26T18:58:22.406Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:22.406Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_name": null, "from_type": "Indicator", "id": "f345096a-8871-44ac-8f8a-679d3a3e501c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--4705d1c2-749d-5875-ae88-d3f8f20265d3", "toId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "to_name": "Remus", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.681Z", "created_at": "2026-09-26T18:58:50.988Z", "modified": "2026-09-26T18:58:51.247Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:51.247Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_id": "d628d192-0961-470a-b5e6-ad8b9488908b", "from_name": null, "from_type": "Indicator", "id": "f4dd91d8-7892-467b-9f1c-0cdf35f9629b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--213c60a8-7cd6-5c7d-a117-fefb1759dd50", "toId": "65de75f2-577f-475e-9394-05450cc05a45", "to_id": "65de75f2-577f-475e-9394-05450cc05a45", "to_name": "LummaC2", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.653Z", "created_at": "2026-09-26T18:58:04.838Z", "modified": "2026-09-26T18:58:05.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:58:05.305Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "from_name": null, "from_type": "Indicator", "id": "f7e74114-5668-49ee-9f8e-c9b3d099ed74", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--7145af1d-bcf3-5456-9ec4-b45805e9c37b", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.612Z", "created_at": "2026-09-26T18:55:35.398Z", "modified": "2026-09-26T18:55:35.557Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:35.557Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "from_name": null, "from_type": "Indicator", "id": "f968fb19-5c12-4064-8389-59449d9022fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--05edcd02-e3d9-57f4-9ba3-aa93bd0f4a22", "toId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "to_name": "Vidar", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.594Z", "created_at": "2026-09-26T18:55:30.998Z", "modified": "2026-09-26T18:55:31.303Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:55:31.303Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "from_name": null, "from_type": "Indicator", "id": "fa2f4773-7edc-4f1f-a6b8-290dcfd78585", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--5c898dd0-c3fb-5eba-a9fe-e7ad45d197f5", "toId": "c249d5a8-bb2a-4675-9414-cb305cedcb3c", "to_id": "c249d5a8-bb2a-4675-9414-cb305cedcb3c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.711Z", "created_at": "2026-09-26T18:59:31.692Z", "modified": "2026-09-26T18:59:33.800Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:59:33.800Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "from_name": null, "from_type": "Indicator", "id": "fb2b147b-9745-4dee-aa43-52500b35495f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--8dad0a51-09bf-5d34-8ad1-3f4640d6742e", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:38:57.608Z", "modified": "2026-01-18T14:38:58.126Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:58.126Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0edd7cee-c750-4a70-82dc-a493fef311a8", "from_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "from_name": "Southern Asia", "from_type": "Region", "id": "fc94576d-aa18-45ec-b2d5-c5fc89a3a2ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--a6d11fc4-a24e-5137-a9f8-f178f9ed60de", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:58.756Z", "created_at": "2026-09-26T19:01:16.764Z", "modified": "2026-09-26T19:01:17.132Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:01:17.132Z" }, "description_available": false, "entity_type": "indicates", "fromId": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "from_name": null, "from_type": "Indicator", "id": "fe5b3caf-f7b6-4963-a097-1f65148b8664", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--6f3c41d5-7282-508f-90c8-aa25db714277", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "015eab9d9dfbb6479f6001b0ec5d5f7c", "description_available": false, "object_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "object_ids": [ "23079917-2b9f-467f-ab29-456bc011fbbf", "4414ed01-e722-45c6-82b5-0c32c07f81e3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4414ed01-e722-45c6-82b5-0c32c07f81e3", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "015eab9d9dfbb6479f6001b0ec5d5f7c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "23079917-2b9f-467f-ab29-456bc011fbbf", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "015eab9d9dfbb6479f6001b0ec5d5f7c" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "md5", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "015eab9d9dfbb6479f6001b0ec5d5f7c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "01751fdcd020df3de36c18b2c65e319c", "description_available": false, "object_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "object_ids": [ "21747585-e7f5-472d-a4be-4d1746195f5a", "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6e9d7e30-a6a9-47b4-a0f2-a8710ba666f4", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01751fdcd020df3de36c18b2c65e319c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "21747585-e7f5-472d-a4be-4d1746195f5a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "01751fdcd020df3de36c18b2c65e319c" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "md5", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01751fdcd020df3de36c18b2c65e319c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "01b0c7fb95f3bd473afc02c295b6accc", "description_available": false, "object_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "object_ids": [ "b42bafb8-c3b9-4023-a8fb-e316521def50", "cd8bd88d-ae6b-489d-8a4b-579aa845101e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b42bafb8-c3b9-4023-a8fb-e316521def50", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01b0c7fb95f3bd473afc02c295b6accc" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "cd8bd88d-ae6b-489d-8a4b-579aa845101e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "01b0c7fb95f3bd473afc02c295b6accc" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "md5", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01b0c7fb95f3bd473afc02c295b6accc" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "01cd5d41e875224867c385ae931b7b4e", "description_available": false, "object_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "object_ids": [ "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "fd9d7f6d-6cd7-4d7f-8388-2152298e576e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5aa56ee0-bcae-4b1b-bcbc-383590abb7ef", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01cd5d41e875224867c385ae931b7b4e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "fd9d7f6d-6cd7-4d7f-8388-2152298e576e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "01cd5d41e875224867c385ae931b7b4e" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "md5", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01cd5d41e875224867c385ae931b7b4e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "01dfd32fa42c976b09bad618a84ebc67", "description_available": false, "object_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "object_ids": [ "c249d5a8-bb2a-4675-9414-cb305cedcb3c", "e936df16-c854-4a84-8bd6-5913a45b2f8c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e936df16-c854-4a84-8bd6-5913a45b2f8c", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01dfd32fa42c976b09bad618a84ebc67" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c249d5a8-bb2a-4675-9414-cb305cedcb3c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "01dfd32fa42c976b09bad618a84ebc67" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "md5", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "01dfd32fa42c976b09bad618a84ebc67" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "62f8c0ecc7ab0ec15c056bc8c7ffe05e43d83531", "description_available": false, "object_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "object_ids": [ "26055e1c-f219-4438-8b5d-967d8d83dc11", "f486bfad-59ed-43b8-a426-05709f9c4a86" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "26055e1c-f219-4438-8b5d-967d8d83dc11", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "62f8c0ecc7ab0ec15c056bc8c7ffe05e43d83531" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f486bfad-59ed-43b8-a426-05709f9c4a86", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "62f8c0ecc7ab0ec15c056bc8c7ffe05e43d83531" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "sha1", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "62f8c0ecc7ab0ec15c056bc8c7ffe05e43d83531" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "64e9c4abc663d8f8780185144e03e9c7bc4c847f", "description_available": false, "object_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "object_ids": [ "0441b824-dbb6-4b77-a143-1e512dd8ae05", "0e0d7117-172a-427c-a96a-e5468e59bfae" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0e0d7117-172a-427c-a96a-e5468e59bfae", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "64e9c4abc663d8f8780185144e03e9c7bc4c847f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0441b824-dbb6-4b77-a143-1e512dd8ae05", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "64e9c4abc663d8f8780185144e03e9c7bc4c847f" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "sha1", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "64e9c4abc663d8f8780185144e03e9c7bc4c847f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e4b895404f2512e8e4d19d5352669181a11f5f63", "description_available": false, "object_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "object_ids": [ "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "e3607c43-ea91-4f9b-8b3f-e86c3295a7aa" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0c0ec870-9e26-4051-aca9-a46ba2049b3f", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "e4b895404f2512e8e4d19d5352669181a11f5f63" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e3607c43-ea91-4f9b-8b3f-e86c3295a7aa", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e4b895404f2512e8e4d19d5352669181a11f5f63" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "sha1", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "e4b895404f2512e8e4d19d5352669181a11f5f63" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "54e378e35d80ccebba22abd63d23909e8533df4a4713afbcef05c1592e465e5d", "description_available": false, "object_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "object_ids": [ "8a2da631-c2a5-4ff3-9131-daee7696c8c3", "be50236c-5a1b-4a73-906c-9f0b71f5a34e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "be50236c-5a1b-4a73-906c-9f0b71f5a34e", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "54e378e35d80ccebba22abd63d23909e8533df4a4713afbcef05c1592e465e5d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8a2da631-c2a5-4ff3-9131-daee7696c8c3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "54e378e35d80ccebba22abd63d23909e8533df4a4713afbcef05c1592e465e5d" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "sha256", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "54e378e35d80ccebba22abd63d23909e8533df4a4713afbcef05c1592e465e5d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "5f3939ab860a1d2b1a08e168ee45925423bf722e46e292c2b710ca9f4cedf27a", "description_available": false, "object_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "object_ids": [ "7c7e7bec-7319-476c-95df-39cf14affd0a", "aff2e967-1676-4e8b-9ec1-176a0c774c0c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "aff2e967-1676-4e8b-9ec1-176a0c774c0c", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "5f3939ab860a1d2b1a08e168ee45925423bf722e46e292c2b710ca9f4cedf27a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "7c7e7bec-7319-476c-95df-39cf14affd0a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "5f3939ab860a1d2b1a08e168ee45925423bf722e46e292c2b710ca9f4cedf27a" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "sha256", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "5f3939ab860a1d2b1a08e168ee45925423bf722e46e292c2b710ca9f4cedf27a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c375cb55dafefcb4ad4fdad99e58159943b9e1c51c7756c2e7880656881fc0f0", "description_available": false, "object_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "object_ids": [ "4142447f-d0d7-43b0-bfc7-2c6494df208d", "d393e4fe-805d-4eae-88d6-0528aff37489" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4142447f-d0d7-43b0-bfc7-2c6494df208d", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "c375cb55dafefcb4ad4fdad99e58159943b9e1c51c7756c2e7880656881fc0f0" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d393e4fe-805d-4eae-88d6-0528aff37489", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c375cb55dafefcb4ad4fdad99e58159943b9e1c51c7756c2e7880656881fc0f0" } ], "source_url": "https://asec.ahnlab.com/en/95519/", "type": "sha256", "valid_from": "2026-09-22T13:13:36.000Z", "valid_until": "2027-07-10T00:23:20.557Z", "validity_status": "active", "value": "c375cb55dafefcb4ad4fdad99e58159943b9e1c51c7756c2e7880656881fc0f0" } ], "mentioned": [ { "confidence": 50, "evidence_id": "ea4de683-0cad-4497-a044-65b61045d534", "name": "T1574.002", "role": "mentionné", "type": "Attack-Pattern" }, { "confidence": 50, "evidence_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "name": "ACRStealer", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "name": "Remus", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "name": "Africa", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "name": "Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "name": "Southern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "name": "Sub-Saharan Africa", "role": "mentionné", "type": "Region" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.523Z", "created_at": "2026-03-14T10:20:06.267Z", "modified": "2026-03-14T10:20:06.591Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:20:06.591Z" }, "description_available": false, "entity_type": "uses", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "715fd86a-1d21-49b7-97cf-a6a4db0628c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--73b98a83-e1d5-5c74-bfbe-ee99a9e524f1", "toId": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "to_id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "to_name": "T1085", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:48:01.534Z", "created_at": "2026-03-14T10:20:12.932Z", "modified": "2026-03-14T10:20:13.645Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-14T10:20:13.645Z" }, "description_available": false, "entity_type": "uses", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "7abf4137-85af-46e1-b19f-2a2206a91b82", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--8b4bb00c-398a-533a-a602-9120ff997b81", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:23:53.533Z", "created_at": "2026-03-09T14:49:04.089Z", "modified": "2026-03-09T14:49:04.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-09T14:49:04.305Z" }, "description_available": false, "entity_type": "uses", "fromId": "65de75f2-577f-475e-9394-05450cc05a45", "from_id": "65de75f2-577f-475e-9394-05450cc05a45", "from_name": "LummaC2", "from_type": "Malware", "id": "fc2e387e-05ff-4fad-a917-318c540c020c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--5d49922e-4f71-5c32-967f-e995d995661e", "toId": "a7cf9af6-78a3-4678-b508-471120b152ba", "to_id": "a7cf9af6-78a3-4678-b508-471120b152ba", "to_name": "T1035", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1085" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:02:56.967Z", "created_by": null, "dates": { "created": "2026-01-18T18:02:56.967Z", "created_at": "2026-01-18T18:20:24.501Z", "modified": "2026-01-18T18:20:26.536Z", "updated_at": "2026-01-18T18:20:26.536Z" }, "description_available": false, "evidence_ids": [ "715fd86a-1d21-49b7-97cf-a6a4db0628c9", "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0" ], "external_id": "T1085", "id": "a6283c3d-9a76-48e7-a3ad-bdbf9e2c97b0", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1085", "modified": "2026-01-18T18:20:26.536Z", "name": "T1085", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1085", "id": "584a166f-e9d7-4867-b842-dcf1ba7a5aaf", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1085" } ], "relationship_ids": [ "715fd86a-1d21-49b7-97cf-a6a4db0628c9" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1085/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1035" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.681Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.681Z", "created_at": "2026-01-18T22:32:40.894Z", "modified": "2026-01-18T22:32:43.177Z", "updated_at": "2026-01-18T22:32:43.177Z" }, "description_available": false, "evidence_ids": [ "a7cf9af6-78a3-4678-b508-471120b152ba", "fc2e387e-05ff-4fad-a917-318c540c020c" ], "external_id": "T1035", "id": "a7cf9af6-78a3-4678-b508-471120b152ba", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1035", "modified": "2026-01-18T22:32:43.177Z", "name": "T1035", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1035", "id": "4d48047f-9cd1-4c60-b685-eb34453e021d", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1035" } ], "relationship_ids": [ "fc2e387e-05ff-4fad-a917-318c540c020c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1035/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "7abf4137-85af-46e1-b19f-2a2206a91b82", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "7abf4137-85af-46e1-b19f-2a2206a91b82" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } ] } ], "via_entity": { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:23:11.594Z", "created_at": "2026-08-09T14:42:59.462Z", "modified": "2026-08-09T14:43:00.290Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-09T14:43:00.290Z" }, "description_available": false, "entity_type": "uses", "fromId": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "from_name": "ACRStealer", "from_type": "Malware", "id": "7b36a4a0-635f-474c-9a50-31e9034e96af", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--457cf861-6e9a-5470-860f-ecdad5ec4795", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "7b36a4a0-635f-474c-9a50-31e9034e96af", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "7b36a4a0-635f-474c-9a50-31e9034e96af" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "name": "ACRStealer", "type": "Malware" } ] } ], "via_entity": { "id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "name": "ACRStealer", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:18:14.122Z", "created_at": "2026-04-25T00:38:20.225Z", "modified": "2026-04-25T00:38:21.265Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-25T00:38:21.265Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "334a86e6-dc29-406b-84c2-e3261979d682", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--6850c2c3-7162-5383-97d2-3f3dc4caaaf6", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:42:00.164Z", "created_at": "2026-03-02T16:49:03.508Z", "modified": "2026-03-02T16:49:03.837Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-02T16:49:03.837Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "be45da20-8023-4cab-856b-6dbf1f622fd5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--284446b2-7eab-5252-b491-15312ee64d78", "toId": "ec63d43c-303b-401d-acf2-f69282aa385f", "to_id": "ec63d43c-303b-401d-acf2-f69282aa385f", "to_name": "T1022", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:12:47.725Z", "created_at": "2026-03-07T15:38:03.133Z", "modified": "2026-03-07T15:38:03.525Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-07T15:38:03.525Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e227e9db-8b50-4dc4-a86b-91d94636e45b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--85a9df8e-c237-5220-a00b-7145d6bfe0c4", "toId": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "to_name": "T1107", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T18:18:00.990Z", "created_at": "2026-02-26T14:25:11.326Z", "modified": "2026-02-26T14:25:13.130Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-26T14:25:13.130Z" }, "description_available": false, "entity_type": "uses", "fromId": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "from_name": "Vidar", "from_type": "Malware", "id": "e40da663-79dd-43d3-911a-b02e2f2a7352", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--1fd2087a-c237-5e58-80e2-4d31fa00722b", "toId": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "to_id": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "to_name": "TA0037", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1107" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.700Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.700Z", "created_at": "2026-01-18T22:33:04.084Z", "modified": "2026-01-18T22:33:05.539Z", "updated_at": "2026-01-18T22:33:05.539Z" }, "description_available": false, "evidence_ids": [ "377ba555-5dfd-4322-a9c5-4ccce578b698", "e227e9db-8b50-4dc4-a86b-91d94636e45b" ], "external_id": "T1107", "id": "377ba555-5dfd-4322-a9c5-4ccce578b698", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1107", "modified": "2026-01-18T22:33:05.539Z", "name": "T1107", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1107", "id": "2fe56096-4b6c-4e42-9d04-6696e9f57d48", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1107" } ], "relationship_ids": [ "e227e9db-8b50-4dc4-a86b-91d94636e45b" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1107/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0037" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T17:54:05.897Z", "created_by": null, "dates": { "created": "2026-01-19T17:54:05.897Z", "created_at": "2026-02-22T11:56:32.763Z", "modified": "2026-02-22T11:56:33.001Z", "updated_at": "2026-02-22T11:56:33.001Z" }, "description_available": false, "evidence_ids": [ "37cb988d-0793-44f1-9c02-4a4c073a2f65", "e40da663-79dd-43d3-911a-b02e2f2a7352" ], "external_id": null, "id": "37cb988d-0793-44f1-9c02-4a4c073a2f65", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-22T11:56:33.001Z", "name": "TA0037", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0037", "id": "d76e185f-fd09-4036-a538-7c4307ef3ae4", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0037" } ], "relationship_ids": [ "e40da663-79dd-43d3-911a-b02e2f2a7352" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": null, "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "334a86e6-dc29-406b-84c2-e3261979d682", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "334a86e6-dc29-406b-84c2-e3261979d682" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1022" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:06:14.577Z", "created_by": null, "dates": { "created": "2026-01-18T18:06:14.577Z", "created_at": "2026-01-19T06:44:21.850Z", "modified": "2026-01-19T06:44:22.697Z", "updated_at": "2026-01-19T06:44:22.697Z" }, "description_available": false, "evidence_ids": [ "be45da20-8023-4cab-856b-6dbf1f622fd5", "ec63d43c-303b-401d-acf2-f69282aa385f" ], "external_id": "T1022", "id": "ec63d43c-303b-401d-acf2-f69282aa385f", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1022", "modified": "2026-01-19T06:44:22.697Z", "name": "T1022", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1022", "id": "9aae6d73-a71c-4f60-bb5a-233ac9db913a", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1022" } ], "relationship_ids": [ "be45da20-8023-4cab-856b-6dbf1f622fd5" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1022/", "via_entities": [ { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } ] } ], "via_entity": { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:23:11.579Z", "created_at": "2026-08-09T14:42:15.545Z", "modified": "2026-08-09T14:42:18.178Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-09T14:42:18.178Z" }, "description_available": false, "entity_type": "uses", "fromId": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "from_name": "Remus", "from_type": "Malware", "id": "387c6108-58c0-4c8c-8706-1432f9148fb6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "standard_id": "relationship--66c007a9-9b82-5a4a-82d3-3d96c16caab4", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "387c6108-58c0-4c8c-8706-1432f9148fb6", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "387c6108-58c0-4c8c-8706-1432f9148fb6" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "name": "Remus", "type": "Malware" } ] } ], "via_entity": { "id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "name": "Remus", "type": "Malware" } } ], "direct_techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "0b5d52f2-7fc0-46ae-832c-56f2d5f5e86f", "334a86e6-dc29-406b-84c2-e3261979d682", "387c6108-58c0-4c8c-8706-1432f9148fb6", "3b9e1158-099c-441d-831d-8a26b1da20fb", "54824c2e-e2d8-4b6b-b07d-089c4b7cb937", "5c9c1f04-504d-415b-b9a7-824f47e90e57", "7346bad9-2cce-4c38-a4a7-12ecd75b32f6", "7abf4137-85af-46e1-b19f-2a2206a91b82", "7b36a4a0-635f-474c-9a50-31e9034e96af", "84730a17-65fd-4f9f-94c3-86430e548450", "aeb61bd8-30e4-415f-871d-bde74a567fe1", "b2bb86b8-832b-4436-af44-5b2093338513", "cc42f559-595d-48d3-a573-6efaf3618fcd", "da611403-cd4d-4826-b3bb-bb60a43110ea", "ea4de683-0cad-4497-a044-65b61045d534", "fb2b147b-9745-4dee-aa43-52500b35495f", "fe5b3caf-f7b6-4963-a097-1f65148b8664" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "0b5d52f2-7fc0-46ae-832c-56f2d5f5e86f", "334a86e6-dc29-406b-84c2-e3261979d682", "387c6108-58c0-4c8c-8706-1432f9148fb6", "3b9e1158-099c-441d-831d-8a26b1da20fb", "54824c2e-e2d8-4b6b-b07d-089c4b7cb937", "5c9c1f04-504d-415b-b9a7-824f47e90e57", "7346bad9-2cce-4c38-a4a7-12ecd75b32f6", "7abf4137-85af-46e1-b19f-2a2206a91b82", "7b36a4a0-635f-474c-9a50-31e9034e96af", "84730a17-65fd-4f9f-94c3-86430e548450", "aeb61bd8-30e4-415f-871d-bde74a567fe1", "b2bb86b8-832b-4436-af44-5b2093338513", "cc42f559-595d-48d3-a573-6efaf3618fcd", "da611403-cd4d-4826-b3bb-bb60a43110ea", "fb2b147b-9745-4dee-aa43-52500b35495f", "fe5b3caf-f7b6-4963-a097-1f65148b8664" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" }, { "id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "name": "ACRStealer", "type": "Malware" }, { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" }, { "id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "name": "Remus", "type": "Malware" } ] } ], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T13:50:39Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1022/", "created": "2017-05-31T21:30:30.260Z", "deprecated": false, "matched": true, "mitre_id": "T1022", "modified": "2025-10-24T17:49:27.757Z", "official_name": "Data Encrypted", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0010", "name": "Exfiltration", "shortname": "exfiltration" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1560/", "mitre_id": "T1560", "official_name": "Archive Collected Data", "official_status": "active", "relationship_id": "relationship--96f5f245-a67b-4e3d-8d3f-ef2a7719a3fd", "stix_id": "attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a" } ], "revoked": true, "stix_id": "attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1035/", "created": "2017-05-31T21:30:36.550Z", "deprecated": false, "matched": true, "mitre_id": "T1035", "modified": "2025-10-24T17:49:36.592Z", "official_name": "Service Execution", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1569/002/", "mitre_id": "T1569.002", "official_name": "Service Execution", "official_status": "active", "relationship_id": "relationship--8f5086fd-1cae-4f43-8a23-e47ace0620db", "stix_id": "attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4" } ], "revoked": true, "stix_id": "attack-pattern--f44731de-ea9f-406d-9b83-30ecbb9b4392" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1085/", "created": "2017-05-31T21:31:06.045Z", "deprecated": false, "matched": true, "mitre_id": "T1085", "modified": "2026-04-14T22:53:14.952Z", "official_name": "Rundll32", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1218/011/", "mitre_id": "T1218.011", "official_name": "Rundll32", "official_status": "active", "relationship_id": "relationship--4d7a9d82-1400-42bd-982a-3e0e4d9396fa", "stix_id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5" } ], "revoked": true, "stix_id": "attack-pattern--62b8c999-dcc0-4755-bd69-09442d9359f5" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1107/", "created": "2017-05-31T21:31:17.915Z", "deprecated": false, "matched": true, "mitre_id": "T1107", "modified": "2026-04-14T22:53:14.915Z", "official_name": "File Deletion", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1070/004/", "mitre_id": "T1070.004", "official_name": "File Deletion", "official_status": "active", "relationship_id": "relationship--f6514d17-d599-4a45-93b2-a80b4aa39dde", "stix_id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c" } ], "revoked": true, "stix_id": "attack-pattern--56fca983-1cf1-4fd1-bda0-5e170a37ab59" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-22T13:13:35.394Z", "created_at": "2026-09-26T19:02:13.357Z", "modified": "2026-09-26T19:02:34.464Z", "published": "2026-09-22T13:13:35.394Z", "updated_at": "2026-09-26T19:02:34.464Z" }, "description_available": true, "id": "2db746cc-c905-4e70-8510-885d1cbbf35c", "is_inferred": false, "labels": [ "acrstealer", "agenttesla", "dll side-loading", "email distribution", "formbook", "infostealer", "lummac2", "remus", "seo poisoning", "vidar" ], "lang": "en", "name": "August 2026 Infostealer Trend Report", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-22T13:13:35.394Z", "references": [ { "external_id": null, "id": "f3e6d754-40a4-42a5-9b54-41deedd8a537", "source_name": "alien-vault", "url": "https://asec.ahnlab.com/en/95519/" }, { "external_id": "6ab27eff37df954a32a9fa29", "id": "48a4412b-28f7-4ead-9075-994012ad12e4", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ab27eff37df954a32a9fa29" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://asec.ahnlab.com/en/95519/" }, "targets": [ { "confidence": 50, "evidence_id": "da82b3dd-ec4f-431c-9402-8292031eab78", "name": "British Indian Ocean Territory", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "bf2144f5-e630-4006-be00-0e09c2901f14", "name": "Finance", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "d1dd24b0-1667-40de-b45b-13d101696bed", "name": "India", "role": "cible déclarée (relation targets)", "type": "Country" } ], "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "0b5d52f2-7fc0-46ae-832c-56f2d5f5e86f", "334a86e6-dc29-406b-84c2-e3261979d682", "387c6108-58c0-4c8c-8706-1432f9148fb6", "3b9e1158-099c-441d-831d-8a26b1da20fb", "54824c2e-e2d8-4b6b-b07d-089c4b7cb937", "5c9c1f04-504d-415b-b9a7-824f47e90e57", "7346bad9-2cce-4c38-a4a7-12ecd75b32f6", "7abf4137-85af-46e1-b19f-2a2206a91b82", "7b36a4a0-635f-474c-9a50-31e9034e96af", "84730a17-65fd-4f9f-94c3-86430e548450", "aeb61bd8-30e4-415f-871d-bde74a567fe1", "b2bb86b8-832b-4436-af44-5b2093338513", "cc42f559-595d-48d3-a573-6efaf3618fcd", "da611403-cd4d-4826-b3bb-bb60a43110ea", "ea4de683-0cad-4497-a044-65b61045d534", "fb2b147b-9745-4dee-aa43-52500b35495f", "fe5b3caf-f7b6-4963-a097-1f65148b8664" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "0b5d52f2-7fc0-46ae-832c-56f2d5f5e86f", "334a86e6-dc29-406b-84c2-e3261979d682", "387c6108-58c0-4c8c-8706-1432f9148fb6", "3b9e1158-099c-441d-831d-8a26b1da20fb", "54824c2e-e2d8-4b6b-b07d-089c4b7cb937", "5c9c1f04-504d-415b-b9a7-824f47e90e57", "7346bad9-2cce-4c38-a4a7-12ecd75b32f6", "7abf4137-85af-46e1-b19f-2a2206a91b82", "7b36a4a0-635f-474c-9a50-31e9034e96af", "84730a17-65fd-4f9f-94c3-86430e548450", "aeb61bd8-30e4-415f-871d-bde74a567fe1", "b2bb86b8-832b-4436-af44-5b2093338513", "cc42f559-595d-48d3-a573-6efaf3618fcd", "da611403-cd4d-4826-b3bb-bb60a43110ea", "fb2b147b-9745-4dee-aa43-52500b35495f", "fe5b3caf-f7b6-4963-a097-1f65148b8664" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/en/95519/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "65de75f2-577f-475e-9394-05450cc05a45", "name": "LummaC2", "type": "Malware" }, { "id": "bf94adcc-6a18-4ef9-8d0a-7d9c5ec16b38", "name": "ACRStealer", "type": "Malware" }, { "id": "d1e72c92-7c83-4ee5-b4b0-9c21b7649ab9", "name": "Vidar", "type": "Malware" }, { "id": "f371fb1f-03cb-4f82-9e75-5fe190e23dc9", "name": "Remus", "type": "Malware" } ] } ], "vulnerabilities": [] }, "report_id": "2db746cc-c905-4e70-8510-885d1cbbf35c", "schema_version": 1, "selected_date": "2026-09-22", "source_url": "https://asec.ahnlab.com/en/95519/" }