{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "ff6cbc7e-c1ce-444a-9348-059f49a2a4b5", "name": "Red Heron", "role": "acteur lié (relation targets)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 0, "deduplicated_iocs": 4, "direct_entities": 105, "direct_relationships": 155, "invalid_iocs": 2, "iocs": 6, "mentioned": 30, "mitre_associated": 0, "mitre_direct": 0, "targets": 60, "techniques": 0, "unsupported_indicators": 2, "vulnerabilities": 12 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 50, "excluded_graph_objects": 476, "graph_complete": true, "graph_objects": 105, "graph_relationships": 155, "mitre_context_complete": true, "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "status_as_of": "2026-10-11T18:27:19+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Country", "aliases": [ "MY", "MYS" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.042Z", "created_at": "2026-01-18T14:36:30.852Z", "modified": "2026-01-27T20:08:24.515Z", "updated_at": "2026-01-27T20:08:24.515Z" }, "description_available": false, "entity_type": "Country", "id": "0425dea7-3eb6-4bae-b195-9e5cdac1c15d", "is_inferred": false, "labels": [], "lang": "en", "name": "Malaysia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--80206d4c-846b-5d96-80e2-ed06f8223680", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.111Z", "modified": "2026-01-18T14:36:09.339Z", "updated_at": "2026-01-18T14:36:09.339Z" }, "description_available": false, "entity_type": "Region", "id": "0584d53c-836c-41a4-a732-0edcc5dea653", "is_inferred": false, "labels": [], "lang": "en", "name": "Americas", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0", "type": "Region" }, { "__typename": "Country", "aliases": [ "MLT", "MT" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.059Z", "created_at": "2026-01-18T14:36:51.980Z", "modified": "2026-04-15T13:54:28.275Z", "updated_at": "2026-04-15T13:54:28.275Z" }, "description_available": false, "entity_type": "Country", "id": "07cbe900-6e4d-4c1e-8ac0-85a6000ba707", "is_inferred": false, "labels": [], "lang": "en", "name": "Malta", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--dbbc1199-687f-5332-bd69-c4ac95d0ddef", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.463Z", "modified": "2026-01-18T14:36:10.115Z", "updated_at": "2026-01-18T14:36:10.115Z" }, "description_available": false, "entity_type": "Region", "id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "is_inferred": false, "labels": [], "lang": "en", "name": "Latin America and the Caribbean", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--db71adf6-45c4-561f-9509-e84092ca174d", "type": "Region" }, { "__typename": "Country", "aliases": [ "PH", "PHL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.042Z", "created_at": "2026-01-18T14:36:31.343Z", "modified": "2026-02-11T20:52:39.420Z", "updated_at": "2026-02-11T20:52:39.420Z" }, "description_available": false, "entity_type": "Country", "id": "0bd2f670-947a-490e-86a7-8ad5b775cb17", "is_inferred": false, "labels": [], "lang": "en", "name": "Philippines", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--6a41d466-2d76-503b-9608-3c2c7ff178c4", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:36:33.627Z", "modified": "2026-01-18T14:36:33.875Z", "updated_at": "2026-01-18T14:36:33.875Z" }, "description_available": false, "entity_type": "Region", "id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "is_inferred": false, "labels": [], "lang": "en", "name": "Southern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--80f5d85d-4b4f-5cb7-b7aa-1771c0afad2e", "type": "Region" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:13:08.932Z", "updated_at": "2026-09-26T19:13:18.329Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "0f1b3995-e279-456f-b374-0b28db1f6749", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "hygiene", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "ipv4-addr--42e1af47-a8ad-585d-af27-5c24b656dead", "type": "IPv4Addr" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:36:53.793Z", "modified": "2026-01-18T14:36:54.026Z", "updated_at": "2026-01-18T14:36:54.026Z" }, "description_available": false, "entity_type": "Region", "id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "is_inferred": false, "labels": [], "lang": "en", "name": "Western Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--a25f43bf-3e2d-55fe-ba09-c63a210f169d", "type": "Region" }, { "__typename": "Country", "aliases": [ "ZA", "ZAF" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.009Z", "created_at": "2026-01-18T14:36:01.103Z", "modified": "2026-01-27T18:28:07.965Z", "updated_at": "2026-01-27T18:28:07.965Z" }, "description_available": false, "entity_type": "Country", "id": "204e3ce5-7698-48bd-a847-07922b85ff44", "is_inferred": false, "labels": [], "lang": "en", "name": "South Africa", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--503b2d50-4ef7-5a53-aedb-8d84c5e1aa62", "type": "Country" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-05-22T02:16:34.390Z", "created_at": "2026-05-22T07:02:16.014Z", "modified": "2026-09-26T19:13:02.874Z", "updated_at": "2026-09-26T19:13:02.874Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "248a7566-ed41-4b3d-9727-3c7b60880f1b", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-34909", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "0dd6b008-a99e-4341-90ff-d6cec98f8b70", "source_name": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/" }, { "external_id": "CVE-2026-34909", "id": "fbc695c0-b08e-4067-b936-1855f8d48952", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34909" }, { "external_id": null, "id": "82742d68-1113-40db-8bdb-bf3a93c67be1", "source_name": "support@hackerone.com", "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--7f703bf0-b267-5dde-8f23-9b9bdd9186f1", "type": "Vulnerability" }, { "__typename": "Sector", "aliases": [ "Bitcoin", "Crypto", "Cryptocurrency", "Currency Exchange", "IT", "Information Security", "Software Development", "Technology", "Virtual Currency", "Vulnerability Research", "software" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.394Z", "created_at": "2026-01-18T14:35:11.762Z", "modified": "2026-03-09T09:41:22.635Z", "updated_at": "2026-03-09T09:41:22.635Z" }, "description_available": true, "entity_type": "Sector", "id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "is_inferred": false, "labels": [], "lang": "en", "name": "Technologies", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "identity--dcacaabc-1244-51fd-8e75-59f4a6fe0aad", "type": "Sector" }, { "__typename": "Country", "aliases": [ "MQ", "MTQ" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.017Z", "created_at": "2026-01-18T14:36:16.026Z", "modified": "2026-03-10T08:28:30.974Z", "updated_at": "2026-03-10T08:28:30.974Z" }, "description_available": false, "entity_type": "Country", "id": "2598896d-b4e0-4301-b370-a40eb7e5d70e", "is_inferred": false, "labels": [], "lang": "en", "name": "Martinique", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--b6575419-9e85-5024-ad63-cbcb5fdb8c94", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:56.218Z", "modified": "2026-01-18T14:36:56.551Z", "updated_at": "2026-01-18T14:36:56.551Z" }, "description_available": false, "entity_type": "Region", "id": "2730372a-ef6c-4210-bc27-805102dc639f", "is_inferred": false, "labels": [], "lang": "en", "name": "Australia and New Zealand", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--8d7fec7f-4e38-53c6-a3dc-904adf4622e8", "type": "Region" }, { "__typename": "Country", "aliases": [ "FR", "FRA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:36:54.393Z", "modified": "2026-01-26T00:00:25.167Z", "updated_at": "2026-01-26T00:00:25.167Z" }, "description_available": false, "entity_type": "Country", "id": "28acec63-0804-49d2-95fa-8beb12f12b33", "is_inferred": false, "labels": [], "lang": "en", "name": "France", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--b8d0549f-de06-5ebd-a6e9-d31a581dba5d", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:35:45.994Z", "modified": "2026-01-18T14:35:46.389Z", "updated_at": "2026-01-18T14:35:46.389Z" }, "description_available": false, "entity_type": "Region", "id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "is_inferred": false, "labels": [], "lang": "en", "name": "Sub-Saharan Africa", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--69cc1e68-fe91-514a-84c6-3379e0109bc3", "type": "Region" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-08-25T00:00:00.000Z", "created_at": "2026-08-26T15:55:38.751Z", "modified": "2026-09-26T07:06:37.356Z", "updated_at": "2026-09-26T07:06:37.356Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "31b901d5-1e5f-4752-9173-f0144572ec05", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-60004", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-60004", "id": "47df4162-0d7e-487a-8dd5-1fbd5bf5a10c", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60004" }, { "external_id": null, "id": "4c04e3de-0729-4b54-af54-1353be914789", "source_name": "cve@mitre.org", "url": "https://blog.gitea.com/release-of-1.27.1/" }, { "external_id": null, "id": "630706fa-d851-49d1-8206-59efdb184d26", "source_name": "cve@mitre.org", "url": "https://github.com/0xBlackash/CVE-2026-60004" }, { "external_id": null, "id": "68819043-5927-40b1-b0c0-d7bf73500522", "source_name": "cve@mitre.org", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m" }, { "external_id": null, "id": "a5da9602-56e6-4cb4-9bf1-b27d4d824c0f", "source_name": "cve@mitre.org", "url": "https://www.runzero.com/blog/gitea/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--9014223b-8b57-5f93-a8c1-c137dafaa61d", "type": "Vulnerability" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2022-04-25T00:00:00.000Z", "created_at": "2026-01-18T18:56:13.147Z", "modified": "2026-02-15T18:50:59.346Z", "updated_at": "2026-02-15T18:50:59.346Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "32a5d6cf-94de-41cb-93a4-f1535d89cf14", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2022-0847", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2022-0847", "id": "feefa805-7081-4b38-a243-6fbab8f6cbde", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0847" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--20c2770b-7005-5923-ba46-f5b7fd4bc8d6", "type": "Vulnerability" }, { "__typename": "Country", "aliases": [ "US", "USA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.034Z", "created_at": "2026-01-18T14:36:25.804Z", "modified": "2026-01-20T20:57:15.092Z", "updated_at": "2026-01-20T20:57:15.092Z" }, "description_available": false, "entity_type": "Country", "id": "3460c7f0-1521-461b-af64-2de060664fb1", "is_inferred": false, "labels": [], "lang": "en", "name": "United States of America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--e79b4cf1-a256-5efa-bc74-c94c7c7ffde0", "type": "Country" }, { "__typename": "Country", "aliases": [ "PA", "PAN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.026Z", "created_at": "2026-01-18T14:36:21.509Z", "modified": "2026-03-21T15:25:20.480Z", "updated_at": "2026-03-21T15:25:20.480Z" }, "description_available": false, "entity_type": "Country", "id": "37b0f937-8e43-404b-8120-dd53e54102b0", "is_inferred": false, "labels": [], "lang": "en", "name": "Panama", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--1a063b5d-6b9f-5e65-a4c7-cccc5b20d19f", "type": "Country" }, { "__typename": "Country", "aliases": [ "MC", "MCO" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:36:55.146Z", "modified": "2026-03-10T08:28:37.952Z", "updated_at": "2026-03-10T08:28:37.952Z" }, "description_available": false, "entity_type": "Country", "id": "39c8e739-b7f2-4a6c-bea0-facfb73d6cd9", "is_inferred": false, "labels": [], "lang": "en", "name": "Monaco", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--05e39dc1-2669-5bb2-adcb-5980c76841c5", "type": "Country" }, { "__typename": "Country", "aliases": [ "CR", "CRI" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.022Z", "created_at": "2026-01-18T14:36:19.586Z", "modified": "2026-02-02T18:43:28.680Z", "updated_at": "2026-02-02T18:43:28.680Z" }, "description_available": false, "entity_type": "Country", "id": "39f69425-0763-4b1f-abff-f0a67ab24fb5", "is_inferred": false, "labels": [], "lang": "en", "name": "Costa Rica", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--c0c9955e-e70f-5d2a-b5b6-ef79c8460a95", "type": "Country" }, { "__typename": "Country", "aliases": [ "PAK", "PK" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.045Z", "created_at": "2026-01-18T14:36:35.644Z", "modified": "2026-05-03T20:51:56.585Z", "updated_at": "2026-05-03T20:51:56.585Z" }, "description_available": false, "entity_type": "Country", "id": "3c1bc586-80e4-4c02-8766-2549979a6b66", "is_inferred": false, "labels": [], "lang": "en", "name": "Pakistan", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--7a7459a2-b38d-561f-bd9f-8b3a0760cc10", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:36:24.671Z", "modified": "2026-01-18T14:36:24.965Z", "updated_at": "2026-01-18T14:36:24.965Z" }, "description_available": false, "entity_type": "Region", "id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--713e5fdc-da7b-5735-958d-d7dc664efa7f", "type": "Region" }, { "__typename": "Country", "aliases": [ "AU", "AUS" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:56.389Z", "modified": "2026-01-26T07:42:24.959Z", "updated_at": "2026-01-26T07:42:24.959Z" }, "description_available": false, "entity_type": "Country", "id": "402b2086-638d-4a79-88bb-c79acff485d8", "is_inferred": false, "labels": [], "lang": "en", "name": "Australia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--6004efb1-d850-551c-af0d-4717244377a8", "type": "Country" }, { "__typename": "Country", "aliases": [ "GR", "GRC" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.058Z", "created_at": "2026-01-18T14:36:51.323Z", "modified": "2026-02-14T20:49:49.559Z", "updated_at": "2026-02-14T20:49:49.559Z" }, "description_available": false, "entity_type": "Country", "id": "44e9dff0-dc9c-4409-82c2-284087fdf928", "is_inferred": false, "labels": [], "lang": "en", "name": "Greece", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--b38c590e-6d73-58f7-91ac-e7adba2a7acd", "type": "Country" }, { "__typename": "Country", "aliases": [ "TW", "TWA", "TWN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.041Z", "created_at": "2026-01-18T14:36:29.625Z", "modified": "2026-01-30T19:18:03.710Z", "updated_at": "2026-01-30T19:18:03.710Z" }, "description_available": false, "entity_type": "Country", "id": "44f005d1-ae5e-4d44-99e6-a75203662d2d", "is_inferred": false, "labels": [], "lang": "en", "name": "Taiwan", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--0311fe2c-ad57-57f5-aab3-98df95ed822d", "type": "Country" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-09-01T22:17:10.283Z", "created_at": "2026-09-02T01:31:34.272Z", "modified": "2026-09-26T19:13:03.977Z", "updated_at": "2026-09-26T19:13:03.977Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "453ee776-b61e-4171-8009-fc5407da6913", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2023-54391", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2023-54391", "id": "df1f2bf8-4734-4236-b56a-527323831876", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54391" }, { "external_id": null, "id": "c2d22ef0-2683-4341-b3a3-410bd00e1ebc", "source_name": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--4cc7280d-48e1-5031-a216-41552b8da910", "type": "Vulnerability" }, { "__typename": "Country", "aliases": [ "PL", "POL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:36:43.801Z", "modified": "2026-01-29T11:10:52.131Z", "updated_at": "2026-01-29T11:10:52.131Z" }, "description_available": false, "entity_type": "Country", "id": "45ceffa5-90ff-48b8-b920-1d211baf5981", "is_inferred": false, "labels": [], "lang": "en", "name": "Poland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--1b912957-41a5-55bf-a3ae-547612b0fda2", "type": "Country" }, { "__typename": "Country", "aliases": [ "UZ", "UZB" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.037Z", "created_at": "2026-01-18T14:36:27.157Z", "modified": "2026-02-05T20:58:19.222Z", "updated_at": "2026-02-05T20:58:19.222Z" }, "description_available": false, "entity_type": "Country", "id": "48234104-26a2-456c-9996-47333cb1ea79", "is_inferred": false, "labels": [], "lang": "en", "name": "Uzbekistan", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--09b86688-76c9-51c9-8b34-d42849c4bc2c", "type": "Country" }, { "__typename": "Country", "aliases": [ "AT", "AUT" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:36:53.957Z", "modified": "2026-01-25T18:49:17.778Z", "updated_at": "2026-01-25T18:49:17.778Z" }, "description_available": false, "entity_type": "Country", "id": "489efa86-e1fa-4076-be39-0e9fa106df1c", "is_inferred": false, "labels": [], "lang": "en", "name": "Austria", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--43d812a5-c980-54d9-b327-8b59f814328f", "type": "Country" }, { "__typename": "Country", "aliases": [ "MN", "MNG" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:36:29.461Z", "modified": "2026-03-17T05:48:04.405Z", "updated_at": "2026-03-17T05:48:04.405Z" }, "description_available": false, "entity_type": "Country", "id": "4b29d74f-fe60-4f8a-a211-324ea1a572fa", "is_inferred": false, "labels": [], "lang": "en", "name": "Mongolia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--6f9ae1f0-80f6-5dda-a419-79ae2e60ce4e", "type": "Country" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-07-17T20:17:28.490Z", "created_at": "2026-08-08T19:38:44.121Z", "modified": "2026-10-09T03:04:57.542Z", "updated_at": "2026-10-09T03:04:57.542Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "4f275781-30af-4e1e-affa-090a4b6c7f16", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-63030", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-63030", "id": "c7be47ad-ebb4-4e14-b818-2332827f930b", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030" }, { "external_id": null, "id": "0d7ad153-c561-452b-999e-777de3ca0bea", "source_name": "contact@wpscan.com", "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q" }, { "external_id": null, "id": "f8c7c6c5-4157-48d8-bfec-aff07a218bd5", "source_name": "contact@wpscan.com", "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--5e87ff47-2c9a-5582-ab9d-8989913680c1", "type": "Vulnerability" }, { "__typename": "Country", "aliases": [ "HU", "HUN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:36:43.542Z", "modified": "2026-02-14T15:16:42.785Z", "updated_at": "2026-02-14T15:16:42.785Z" }, "description_available": false, "entity_type": "Country", "id": "55aa32ee-212e-4703-b538-80e0de523755", "is_inferred": false, "labels": [], "lang": "en", "name": "Hungary", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--1f2ac9ad-d7e3-5acc-bc69-9287fb32776d", "type": "Country" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-05-22T02:16:34.527Z", "created_at": "2026-05-22T07:02:16.334Z", "modified": "2026-09-26T19:13:02.881Z", "updated_at": "2026-09-26T19:13:02.881Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "57532ce3-ad83-46ae-82eb-674ed56967fb", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-34910", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "0dd6b008-a99e-4341-90ff-d6cec98f8b70", "source_name": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/" }, { "external_id": "CVE-2026-34910", "id": "df0fb7fe-4d1a-4eb4-a255-313564110af2", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34910" }, { "external_id": null, "id": "82742d68-1113-40db-8bdb-bf3a93c67be1", "source_name": "support@hackerone.com", "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--04ab4b7e-c12a-5500-beb2-b24041bc7c45", "type": "Vulnerability" }, { "__typename": "Country", "aliases": [ "EE", "EST" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.054Z", "created_at": "2026-01-18T14:36:47.133Z", "modified": "2026-02-05T19:21:15.150Z", "updated_at": "2026-02-05T19:21:15.150Z" }, "description_available": false, "entity_type": "Country", "id": "59722221-e14e-4a05-ab01-f9f7c9fc83ab", "is_inferred": false, "labels": [], "lang": "en", "name": "Estonia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--a13bf415-a07f-548f-ab9c-ae95e72b78d7", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.665Z", "created_at": "2026-09-26T19:13:10.155Z", "modified": "2026-09-26T19:13:16.215Z", "updated_at": "2026-09-26T19:13:16.215Z" }, "description_available": false, "entity_type": "Indicator", "id": "5a1c6344-c106-4956-bee5-835d59bbd9a1", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "indicator--0c9d1143-c73b-59c6-958c-d594a32d1e5f", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:36:42.735Z", "modified": "2026-01-18T14:36:43.019Z", "updated_at": "2026-01-18T14:36:43.019Z" }, "description_available": false, "entity_type": "Region", "id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "is_inferred": false, "labels": [], "lang": "en", "name": "Eastern Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--8ff835b1-bf48-511c-9538-c4ee7bfe9bc6", "type": "Region" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:36:27.648Z", "modified": "2026-01-18T14:36:28.240Z", "updated_at": "2026-01-18T14:36:28.240Z" }, "description_available": false, "entity_type": "Region", "id": "5e22af61-1616-46dc-b076-551e7f99593f", "is_inferred": false, "labels": [], "lang": "en", "name": "Eastern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--c5a2d626-2be3-5cee-b643-773a32d19ce0", "type": "Region" }, { "__typename": "Country", "aliases": [ "BE", "BEL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:36:54.385Z", "modified": "2026-01-26T00:22:07.404Z", "updated_at": "2026-01-26T00:22:07.404Z" }, "description_available": false, "entity_type": "Country", "id": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "is_inferred": false, "labels": [], "lang": "en", "name": "Belgium", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--0fa62f48-e653-5f61-b694-85e268235459", "type": "Country" }, { "__typename": "Country", "aliases": [ "IN", "IND" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.044Z", "created_at": "2026-01-18T14:36:34.563Z", "modified": "2026-01-26T13:48:21.782Z", "updated_at": "2026-01-26T13:48:21.782Z" }, "description_available": false, "entity_type": "Country", "id": "6926835d-28e0-4787-97c9-699d0375b12b", "is_inferred": false, "labels": [], "lang": "en", "name": "India", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--0bd9fe72-1184-515b-98b8-6341b3b27996", "type": "Country" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-05-22T02:16:34.240Z", "created_at": "2026-05-22T07:02:11.830Z", "modified": "2026-09-26T19:13:02.245Z", "updated_at": "2026-09-26T19:13:02.245Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "6bf00d62-0c1f-4ab6-a2b6-a0ea715efb88", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-34908", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "0dd6b008-a99e-4341-90ff-d6cec98f8b70", "source_name": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/" }, { "external_id": "CVE-2026-34908", "id": "c62f7bf8-bda8-42f9-8acd-7a4f7a1e3b6f", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34908" }, { "external_id": null, "id": "82742d68-1113-40db-8bdb-bf3a93c67be1", "source_name": "support@hackerone.com", "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--c639cc8e-208f-58c5-8be5-43e003e6bc18", "type": "Vulnerability" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:55.954Z", "modified": "2026-01-18T14:36:56.120Z", "updated_at": "2026-01-18T14:36:56.120Z" }, "description_available": false, "entity_type": "Region", "id": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "is_inferred": false, "labels": [], "lang": "en", "name": "Oceania", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--834c5189-3715-561b-b68a-e835372d05ff", "type": "Region" }, { "__typename": "Country", "aliases": [ "ES", "ESP" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:36:53.564Z", "modified": "2026-01-27T17:48:16.949Z", "updated_at": "2026-01-27T17:48:16.949Z" }, "description_available": false, "entity_type": "Country", "id": "6d717ddf-b5e6-4c07-9b16-ba739399f54a", "is_inferred": false, "labels": [], "lang": "en", "name": "Spain", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--a7e4728d-e904-51c3-8e73-392940c6287c", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:36:42.591Z", "modified": "2026-01-18T14:36:42.746Z", "updated_at": "2026-01-18T14:36:42.746Z" }, "description_available": false, "entity_type": "Region", "id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "is_inferred": false, "labels": [], "lang": "en", "name": "Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--2e9ef300-a1ab-5c9f-9297-dde66b71cae2", "type": "Region" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-08-26T16:16:27.733Z", "created_at": "2026-08-26T19:13:32.995Z", "modified": "2026-09-26T19:13:04.330Z", "updated_at": "2026-09-26T19:13:04.330Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "761ea0f1-54fc-4a33-ae87-2c3f18b3b3db", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-54569", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-54569", "id": "52ab7191-9886-43d7-a827-2e64abf17e18", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54569" }, { "external_id": null, "id": "36414004-f5d5-4cda-8e7b-a91d6bbd1fce", "source_name": "security-advisories@github.com", "url": "https://github.com/senaite/senaite.core/commit/a24d65e99a17ac43c5374ed9f0a60d0fe60d2f74" }, { "external_id": null, "id": "88428b9a-72e1-47d6-882f-a283ae6f972d", "source_name": "security-advisories@github.com", "url": "https://github.com/senaite/senaite.core/commit/ef4b6d73575b0fbc0edc6114e5e025089aaf9eb7" }, { "external_id": null, "id": "0e382b51-1cd8-4565-84f8-8f5ee93f9ce7", "source_name": "security-advisories@github.com", "url": "https://github.com/senaite/senaite.core/pull/2903" }, { "external_id": null, "id": "2872384e-c21e-4a97-9646-f1fee4cfcf9d", "source_name": "security-advisories@github.com", "url": "https://github.com/senaite/senaite.core/pull/2919" }, { "external_id": null, "id": "92a6da84-2ff3-463f-ace9-126529b200e4", "source_name": "security-advisories@github.com", "url": "https://github.com/senaite/senaite.core/security/advisories/GHSA-jrw6-7x4q-w25j" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--6e353c31-a396-5aba-bf41-64b150db696f", "type": "Vulnerability" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:36:26.241Z", "modified": "2026-01-18T14:36:26.385Z", "updated_at": "2026-01-18T14:36:26.385Z" }, "description_available": false, "entity_type": "Region", "id": "765d7d4d-7684-440b-bbcd-4037047b7699", "is_inferred": false, "labels": [], "lang": "en", "name": "Central Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--11d3361e-d6a7-5688-a0b4-cde991ce504d", "type": "Region" }, { "__typename": "Country", "aliases": [ "JP", "JPN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:36:28.776Z", "modified": "2026-01-25T16:24:47.859Z", "updated_at": "2026-01-25T16:24:47.859Z" }, "description_available": false, "entity_type": "Country", "id": "7a370bce-880b-477d-b87c-2fc78164dde9", "is_inferred": false, "labels": [], "lang": "en", "name": "Japan", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--5c26fa61-1bce-5286-900c-9ac7d4d93276", "type": "Country" }, { "__typename": "Country", "aliases": [ "SE", "SWE" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:36:49.459Z", "modified": "2026-02-02T15:21:43.652Z", "updated_at": "2026-02-02T15:21:43.652Z" }, "description_available": false, "entity_type": "Country", "id": "7a72cd9d-d02d-4dae-918b-53a544cea49f", "is_inferred": false, "labels": [], "lang": "en", "name": "Sweden", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--40916b91-5679-5873-8616-4e730862acb7", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:36:26.119Z", "modified": "2026-01-18T14:36:26.275Z", "updated_at": "2026-01-18T14:36:26.275Z" }, "description_available": false, "entity_type": "Region", "id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "is_inferred": false, "labels": [], "lang": "en", "name": "Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--68241bf7-96c8-5542-b488-3b8fe8f51aff", "type": "Region" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-06-05T20:47:52.504Z", "updated_at": "2026-09-26T19:13:07.735Z" }, "description_available": true, "entity_type": "IPv4-Addr", "id": "7d11c550-f9b5-413a-b87d-822e1a3904dd", "is_inferred": false, "labels": [ "botnet_cc", "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "hygiene", "kapibala", "privilege escalation", "vshell", "wordpress exploitation", "zyxel switches" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "ipv4-addr--8a4bf290-dd26-5909-893e-a64e80a8c1c3", "type": "IPv4Addr" }, { "__typename": "Country", "aliases": [ "SI", "SVN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:36:53.359Z", "modified": "2026-01-25T17:09:43.603Z", "updated_at": "2026-01-25T17:09:43.603Z" }, "description_available": false, "entity_type": "Country", "id": "7ddda560-179a-4ff6-af4e-d6cf5291dd73", "is_inferred": false, "labels": [], "lang": "en", "name": "Slovenia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--cfb4dd56-0834-5210-bf01-f4d5da17fb90", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "ipv4" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-06-05T20:32:29.351Z", "created_at": "2026-06-05T20:47:53.217Z", "modified": "2026-09-26T19:13:11.789Z", "updated_at": "2026-09-26T19:13:11.789Z" }, "description_available": true, "entity_type": "Indicator", "id": "7def13ab-2ef4-4447-be92-6ca0d91c791c", "is_inferred": false, "labels": [ "botnet_cc", "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "hygiene", "kapibala", "privilege escalation", "vshell", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "indicator--189a7e4f-7b89-5c30-b4c4-4eaae390b255", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-07-17T20:17:27.790Z", "created_at": "2026-08-08T19:38:17.716Z", "modified": "2026-10-09T03:04:55.099Z", "updated_at": "2026-10-09T03:04:55.099Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "802136a0-c009-4e53-a497-45699929f503", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-60137", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-60137", "id": "eeab7033-2a58-446b-a152-230cec9bf6dc", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137" }, { "external_id": null, "id": "af95d248-7cdd-46b8-b899-0b69c02f24c8", "source_name": "contact@wpscan.com", "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf" }, { "external_id": null, "id": "f8c7c6c5-4157-48d8-bfec-aff07a218bd5", "source_name": "contact@wpscan.com", "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--d73a1121-1a53-590a-aedf-551a012d3a8b", "type": "Vulnerability" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:13:06.488Z", "updated_at": "2026-09-26T19:13:07.737Z" }, "description_available": false, "entity_type": "StixFile", "id": "8080812d-ede9-4e6e-91f1-bdaabe508538", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "file--2b6dcbb4-c5d1-5a2a-9011-c36368b3e3b0", "type": "StixFile" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.045Z", "created_at": "2026-01-18T14:36:36.325Z", "modified": "2026-01-18T14:36:36.981Z", "updated_at": "2026-01-18T14:36:36.981Z" }, "description_available": false, "entity_type": "Region", "id": "83ee16e7-a32f-4c97-ab6a-627957b0b061", "is_inferred": false, "labels": [], "lang": "en", "name": "Middle East", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--a3f7ca42-b35d-5a31-803c-021f784f02b9", "type": "Region" }, { "__typename": "Country", "aliases": [ "AL", "ALB" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:36:50.085Z", "modified": "2026-03-13T19:34:50.245Z", "updated_at": "2026-03-13T19:34:50.245Z" }, "description_available": false, "entity_type": "Country", "id": "880dee21-0fd5-45d3-b468-1d63fe6eff58", "is_inferred": false, "labels": [], "lang": "en", "name": "Albania", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--c2eec911-3ec1-5151-b116-308aadc98d37", "type": "Country" }, { "__typename": "Country", "aliases": [ "LT", "LTU" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.056Z", "created_at": "2026-01-18T14:36:48.763Z", "modified": "2026-03-07T02:04:33.527Z", "updated_at": "2026-03-07T02:04:33.527Z" }, "description_available": false, "entity_type": "Country", "id": "89d766a1-976e-4d7c-8523-f2bdc6ac0c9f", "is_inferred": false, "labels": [], "lang": "en", "name": "Lithuania", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--b8ef43d2-50e0-5dae-94be-a65732605c95", "type": "Country" }, { "__typename": "Country", "aliases": [ "CH", "CHE" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:55.942Z", "modified": "2026-01-27T19:15:37.143Z", "updated_at": "2026-01-27T19:15:37.143Z" }, "description_available": false, "entity_type": "Country", "id": "8a198689-d83f-46bd-98c3-a2f76adae719", "is_inferred": false, "labels": [], "lang": "en", "name": "Switzerland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--d0e7f9bc-8f87-59f9-9b28-a84c1ef2f80f", "type": "Country" }, { "__typename": "Country", "aliases": [ "FI", "FIN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.055Z", "created_at": "2026-01-18T14:36:47.520Z", "modified": "2026-02-09T17:17:11.105Z", "updated_at": "2026-02-09T17:17:11.105Z" }, "description_available": false, "entity_type": "Country", "id": "90fc2c57-deea-4c83-9d78-2445ddbc26c7", "is_inferred": false, "labels": [], "lang": "en", "name": "Finland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--ea0bd48b-b9f9-5e75-8cdd-581afb953ae6", "type": "Country" }, { "__typename": "Country", "aliases": [ "CZ", "CZE" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:36:43.450Z", "modified": "2026-02-20T19:04:30.805Z", "updated_at": "2026-02-20T19:04:30.805Z" }, "description_available": false, "entity_type": "Country", "id": "91a251e1-43ba-49df-87da-035fd51e1e02", "is_inferred": false, "labels": [], "lang": "en", "name": "Czechia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--034603e7-8618-5faa-8287-4e7d414d4b6b", "type": "Country" }, { "__typename": "Country", "aliases": [ "RU", "RUS" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:36:44.323Z", "modified": "2026-02-23T13:44:40.821Z", "updated_at": "2026-02-23T13:44:40.821Z" }, "description_available": false, "entity_type": "Country", "id": "943fd578-2671-43c0-b698-b21b30065383", "is_inferred": false, "labels": [], "lang": "en", "name": "Russian Federation", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--efa1b9b0-dc59-5bad-baa2-4fc495e55fcc", "type": "Country" }, { "__typename": "Country", "aliases": [ "DK", "DNK" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.054Z", "created_at": "2026-01-18T14:36:46.870Z", "modified": "2026-03-01T20:47:59.503Z", "updated_at": "2026-03-01T20:47:59.503Z" }, "description_available": false, "entity_type": "Country", "id": "94b2604c-63f0-4cb3-bcef-f2f82109b72a", "is_inferred": false, "labels": [], "lang": "en", "name": "Denmark", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--21dd8efc-444f-5471-830e-bf50d6549da4", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.677Z", "created_at": "2026-09-26T19:13:14.620Z", "modified": "2026-09-26T19:13:23.797Z", "updated_at": "2026-09-26T19:13:23.797Z" }, "description_available": false, "entity_type": "Indicator", "id": "98534320-ab7e-49ba-b595-7ce86071ff23", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "indicator--9f078e8d-d496-5322-9244-4eebae5d469c", "type": "Indicator" }, { "__typename": "Country", "aliases": [ "PRT", "PT" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.059Z", "created_at": "2026-01-18T14:36:52.597Z", "modified": "2026-02-10T16:10:31.761Z", "updated_at": "2026-02-10T16:10:31.761Z" }, "description_available": false, "entity_type": "Country", "id": "9c55f3b9-481d-4628-83d3-a6fa22f1b0e3", "is_inferred": false, "labels": [], "lang": "en", "name": "Portugal", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--f2b79d70-5bde-5505-be17-4b880b710ccb", "type": "Country" }, { "__typename": "Country", "aliases": [ "NL", "NLD" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:36:55.605Z", "modified": "2026-01-25T16:23:12.672Z", "updated_at": "2026-01-25T16:23:12.672Z" }, "description_available": false, "entity_type": "Country", "id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "is_inferred": false, "labels": [], "lang": "en", "name": "Netherlands", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--5bb85183-8229-549f-a7ed-2630c10c453d", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:36:49.784Z", "modified": "2026-01-18T14:36:49.952Z", "updated_at": "2026-01-18T14:36:49.952Z" }, "description_available": false, "entity_type": "Region", "id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "is_inferred": false, "labels": [], "lang": "en", "name": "Southern Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--702e7644-9f72-56de-a39b-993151d3eaab", "type": "Region" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:13:08.092Z", "updated_at": "2026-09-26T19:13:08.589Z" }, "description_available": false, "entity_type": "StixFile", "id": "a490b7df-8b5f-4fb6-8b69-d009e8627d93", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "file--7888d210-2c1e-5f10-ae33-81b50eb6f00b", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:13:09.549Z", "updated_at": "2026-09-26T19:13:09.761Z" }, "description_available": false, "entity_type": "Hostname", "id": "a4cb6aeb-a168-49c6-a895-c2354fe94740", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "hostname--359390a5-ee2f-5303-8bd7-61345267a28c", "type": "Hostname" }, { "__typename": "Country", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 75, "created_by": null, "dates": { "created": "2026-01-18T18:06:52.454Z", "created_at": "2026-01-18T20:01:56.516Z", "modified": "2026-02-06T13:56:20.071Z", "updated_at": "2026-02-06T13:56:20.071Z" }, "description_available": false, "entity_type": "Country", "id": "a546f442-556c-4599-b76b-874caeb6aaf2", "is_inferred": false, "labels": [], "lang": "en", "name": "Hong Kong", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--289488f1-faaf-5d1e-a8be-fde75005ef25", "type": "Country" }, { "__typename": "Country", "aliases": [ "CHL", "CL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.028Z", "created_at": "2026-01-18T14:36:22.274Z", "modified": "2026-02-02T16:18:23.674Z", "updated_at": "2026-02-02T16:18:23.674Z" }, "description_available": false, "entity_type": "Country", "id": "a5ef5419-3010-463a-833d-6e426d1bc636", "is_inferred": false, "labels": [], "lang": "en", "name": "Chile", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--7a1337b5-7743-5a88-9d95-4597524a17c3", "type": "Country" }, { "__typename": "Country", "aliases": [ "IS", "ISL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.055Z", "created_at": "2026-01-18T14:36:47.672Z", "modified": "2026-02-14T21:00:45.135Z", "updated_at": "2026-02-14T21:00:45.135Z" }, "description_available": false, "entity_type": "Country", "id": "a5f4f35e-0f44-4b6f-858b-931d9a747f20", "is_inferred": false, "labels": [], "lang": "en", "name": "Iceland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--bbe7a7e8-dffd-5a3b-a42e-4adbed4d4483", "type": "Country" }, { "__typename": "Country", "aliases": [ "RO", "ROU" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:36:44.289Z", "modified": "2026-02-02T17:49:47.560Z", "updated_at": "2026-02-02T17:49:47.560Z" }, "description_available": false, "entity_type": "Country", "id": "aad12288-fa3e-4395-a8a0-3c83fd8f0b9f", "is_inferred": false, "labels": [], "lang": "en", "name": "Romania", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--e51a0235-8d2e-50ea-a3cd-9ce69a8012cf", "type": "Country" }, { "__typename": "Country", "aliases": [ "MDG", "MG" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.003Z", "created_at": "2026-01-18T14:35:48.875Z", "modified": "2026-03-10T08:28:19.631Z", "updated_at": "2026-03-10T08:28:19.631Z" }, "description_available": false, "entity_type": "Country", "id": "ad3b50f7-baae-44d8-8e10-5fa57a176a2f", "is_inferred": false, "labels": [], "lang": "en", "name": "Madagascar", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--5c1cc292-021a-5f1f-b09e-a06d063e0e11", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:36.999Z", "created_at": "2026-01-18T14:35:39.076Z", "modified": "2026-01-18T14:35:40.483Z", "updated_at": "2026-01-18T14:35:40.483Z" }, "description_available": false, "entity_type": "Region", "id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "is_inferred": false, "labels": [], "lang": "en", "name": "Africa", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--7e13827c-720f-5725-978b-907dc66a6f6f", "type": "Region" }, { "__typename": "Country", "aliases": [ "BR", "BRA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.027Z", "created_at": "2026-01-18T14:36:22.143Z", "modified": "2026-01-27T18:26:50.850Z", "updated_at": "2026-01-27T18:26:50.850Z" }, "description_available": false, "entity_type": "Country", "id": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "is_inferred": false, "labels": [], "lang": "en", "name": "Brazil", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--080ab8c5-3ae0-5ad5-b46e-1c9506da9f65", "type": "Country" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.666Z", "created_at": "2026-09-26T07:06:29.770Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T07:06:32.642Z", "updated_at": "2026-09-26T07:06:32.642Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "is_inferred": false, "labels": [], "lang": "en", "name": "Red Heron", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "intrusion-set--b5dc822d-7468-5d6a-8d96-00507532d0eb", "type": "IntrusionSet" }, { "__typename": "Country", "aliases": [ "TH", "THA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:36:32.103Z", "modified": "2026-01-27T12:32:03.158Z", "updated_at": "2026-01-27T12:32:03.158Z" }, "description_available": false, "entity_type": "Country", "id": "bbba6d60-0079-4957-bb12-8e1c8f03a5c9", "is_inferred": false, "labels": [], "lang": "en", "name": "Thailand", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--f55f5ba5-2a50-5551-b050-30f111e50b63", "type": "Country" }, { "__typename": "Country", "aliases": [ "BG", "BGR" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:36:43.117Z", "modified": "2026-01-28T05:40:07.633Z", "updated_at": "2026-01-28T05:40:07.633Z" }, "description_available": false, "entity_type": "Country", "id": "c074b72c-bc97-4a80-8672-4638da69a768", "is_inferred": false, "labels": [], "lang": "en", "name": "Bulgaria", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--a77bda61-74b2-5feb-b53b-dc25fe255ba4", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.041Z", "created_at": "2026-01-18T14:36:30.055Z", "modified": "2026-01-18T14:36:30.331Z", "updated_at": "2026-01-18T14:36:30.331Z" }, "description_available": false, "entity_type": "Region", "id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "is_inferred": false, "labels": [], "lang": "en", "name": "South-eastern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--f2bd521a-b95b-5f99-897b-872ba66060b3", "type": "Region" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-07-12T12:16:45.290Z", "created_at": "2026-08-08T22:27:00.722Z", "modified": "2026-09-26T19:13:04.618Z", "updated_at": "2026-09-26T19:13:04.618Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "c26b89cd-81e5-4d81-b9e5-59dc7ebb0e7a", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-56271", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-56271", "id": "3e5f9633-7b95-484a-9b3b-10499b756762", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56271" }, { "external_id": null, "id": "d7d3967e-4e5c-400f-b14f-28decbdc2f01", "source_name": "disclosure@vulncheck.com", "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8" }, { "external_id": null, "id": "a6ef926e-4823-4961-a565-7de7e252f790", "source_name": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/flowise-weak-default-jwt-secrets-in-authentication-middleware" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--abedb4be-7f62-522b-9e4c-1d92e5292007", "type": "Vulnerability" }, { "__typename": "Country", "aliases": [ "DE", "DEU" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:36:54.657Z", "modified": "2026-01-25T15:49:18.680Z", "updated_at": "2026-01-25T15:49:18.680Z" }, "description_available": false, "entity_type": "Country", "id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "is_inferred": false, "labels": [], "lang": "en", "name": "Germany", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--7215cb31-5700-55b2-81b3-633c09c0351d", "type": "Country" }, { "__typename": "Country", "aliases": [ "IT", "ITA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.058Z", "created_at": "2026-01-18T14:36:51.970Z", "modified": "2026-01-25T19:11:49.346Z", "updated_at": "2026-01-25T19:11:49.346Z" }, "description_available": false, "entity_type": "Country", "id": "c4740bb7-1852-488f-935a-7ac938329773", "is_inferred": false, "labels": [], "lang": "en", "name": "Italy", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--d4fdf10e-4bb7-50d7-8ee3-4186168343d2", "type": "Country" }, { "__typename": "Country", "aliases": [ "AE", "ARE" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:36:41.808Z", "modified": "2026-01-27T19:34:00.838Z", "updated_at": "2026-01-27T19:34:00.838Z" }, "description_available": false, "entity_type": "Country", "id": "c8d88472-f56e-445a-be11-f5c5b2794ac4", "is_inferred": false, "labels": [], "lang": "en", "name": "United Arab Emirates", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--0e8caecf-8f3f-5fbf-85fc-6cfb16f407de", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.672Z", "created_at": "2026-09-26T19:13:12.287Z", "modified": "2026-09-26T19:13:49.004Z", "updated_at": "2026-09-26T19:13:49.004Z" }, "description_available": false, "entity_type": "Indicator", "id": "c9fb0937-5fb3-45a2-9d1a-09f04c80c2a5", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "hygiene", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "indicator--357e4b81-6a1b-5ccb-ab7b-ece78d9fb7fa", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-06-16T03:16:13.557Z", "created_at": "2026-06-16T08:42:42.999Z", "modified": "2026-09-26T19:13:03.141Z", "updated_at": "2026-09-26T19:13:03.141Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "cfdc76a1-dbf8-4cfb-88d0-b6a2742b4745", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-7273", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "5d10d6a4-bf46-479a-830e-c9cd3bfc3d08", "source_name": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation" }, { "external_id": "CVE-2026-7273", "id": "f6634233-7105-4454-a326-077122c8178c", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7273" }, { "external_id": null, "id": "92befe1d-22b2-4407-991d-cf188e06014a", "source_name": "security@zyxel.com.tw", "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--6f71203a-bcf1-5f34-bc59-401270fb3312", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.667Z", "created_at": "2026-09-26T19:13:10.318Z", "modified": "2026-09-26T19:13:18.873Z", "updated_at": "2026-09-26T19:13:18.873Z" }, "description_available": false, "entity_type": "Indicator", "id": "d4931a81-8938-4270-ace5-1bad46c5a80c", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "indicator--60398ea0-6226-5564-ad3f-08186bb6278e", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:36:45.082Z", "modified": "2026-01-18T14:36:45.471Z", "updated_at": "2026-01-18T14:36:45.471Z" }, "description_available": false, "entity_type": "Region", "id": "d5563518-7ebb-46ed-a037-525564906cd9", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern Europe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--47a439b0-ad3d-5a9e-8f6a-5de5a7e76d0b", "type": "Region" }, { "__typename": "Country", "aliases": [ "CHN", "CN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:36:28.072Z", "modified": "2026-01-25T16:20:47.967Z", "updated_at": "2026-01-25T16:20:47.967Z" }, "description_available": false, "entity_type": "Country", "id": "d91d9170-3c76-4158-9559-2db658404d55", "is_inferred": false, "labels": [], "lang": "en", "name": "China", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--f5a9dd9f-5d18-5343-8562-ee913912526d", "type": "Country" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-09-02T17:18:00.087Z", "created_at": "2026-09-02T19:34:12.091Z", "modified": "2026-09-26T19:13:05.189Z", "updated_at": "2026-09-26T19:13:05.189Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "da958c05-87dd-4106-b048-60d2894f54bb", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-79756", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-79756", "id": "d65ae26d-e27e-4d97-a067-c111f4d158c6", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79756" }, { "external_id": null, "id": "5fe8c412-e677-4ff1-bc19-0f92d73b9567", "source_name": "security-advisories@github.com", "url": "https://github.com/nuclio/nuclio/commit/86d4e39387d8845f567649201798800830f08411" }, { "external_id": null, "id": "b7659b43-0c77-470e-a04a-54f5fb00280e", "source_name": "security-advisories@github.com", "url": "https://github.com/nuclio/nuclio/pull/4223" }, { "external_id": null, "id": "f13c495e-332d-4bc5-82f4-76f820058a7f", "source_name": "security-advisories@github.com", "url": "https://github.com/nuclio/nuclio/releases/tag/1.17.4" }, { "external_id": null, "id": "6dc00a8b-331b-4638-bfbe-c3eef87415e7", "source_name": "security-advisories@github.com", "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-mq8w-f7w8-5rgg" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "vulnerability--6c256c64-7c82-5e8c-b93f-5d780e7a0c4b", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.670Z", "created_at": "2026-09-26T19:13:11.472Z", "modified": "2026-09-26T19:13:20.057Z", "updated_at": "2026-09-26T19:13:20.057Z" }, "description_available": false, "entity_type": "Indicator", "id": "e065a43d-e6c0-4fd7-846c-3fe32811b1cc", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "indicator--d1023659-d006-5f45-8597-2d42ebae40a9", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:13:08.243Z", "updated_at": "2026-09-26T19:13:16.350Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "e3a7a02f-4e1f-4821-8dba-91ac842e9015", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "hygiene", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "ipv4-addr--79e5b344-27f1-5b7e-bb1a-7ec8c913d5d2", "type": "IPv4Addr" }, { "__typename": "Country", "aliases": [ "SK", "SVK" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:36:44.592Z", "modified": "2026-02-14T16:45:41.651Z", "updated_at": "2026-02-14T16:45:41.651Z" }, "description_available": false, "entity_type": "Country", "id": "e520efd7-16e5-43c4-a14c-17b30bd997f5", "is_inferred": false, "labels": [], "lang": "en", "name": "Slovakia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--0359730b-8b68-596e-ad90-92f5e5f05062", "type": "Country" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T19:13:06.376Z", "updated_at": "2026-09-26T19:13:07.081Z" }, "description_available": false, "entity_type": "StixFile", "id": "e93697ef-3aa1-41ea-92f9-eccd0b471766", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "file--97ca1fbc-45d1-56ce-9e95-0c2e788d77ea", "type": "StixFile" }, { "__typename": "Country", "aliases": [ "GB", "GBR" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:36:49.586Z", "modified": "2026-01-21T04:27:12.575Z", "updated_at": "2026-01-21T04:27:12.575Z" }, "description_available": false, "entity_type": "Country", "id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "is_inferred": false, "labels": [], "lang": "en", "name": "United Kingdom of Great Britain and Northern Ireland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--66421b20-2d5d-5586-8703-48da4d727028", "type": "Country" }, { "__typename": "Country", "aliases": [ "LV", "LVA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.056Z", "created_at": "2026-01-18T14:36:48.533Z", "modified": "2026-01-27T19:16:24.284Z", "updated_at": "2026-01-27T19:16:24.284Z" }, "description_available": false, "entity_type": "Country", "id": "f3521355-05dc-4951-b97e-0fa007cf66f3", "is_inferred": false, "labels": [], "lang": "en", "name": "Latvia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--178dbad0-4002-57bb-ab37-878a9534c979", "type": "Country" }, { "__typename": "Country", "aliases": [ "BLR", "BY" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:36:43.013Z", "modified": "2026-08-17T13:09:14.721Z", "updated_at": "2026-08-17T13:09:14.721Z" }, "description_available": false, "entity_type": "Country", "id": "f4193c66-63e1-4298-a814-205542e00106", "is_inferred": false, "labels": [], "lang": "en", "name": "Belarus", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--bbf51f0d-4ff3-533f-a040-7540a21385d6", "type": "Country" }, { "__typename": "Country", "aliases": [ "IO", "IOT" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:35:46.139Z", "modified": "2026-03-05T15:26:02.116Z", "updated_at": "2026-03-05T15:26:02.116Z" }, "description_available": false, "entity_type": "Country", "id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "is_inferred": false, "labels": [], "lang": "en", "name": "British Indian Ocean Territory", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--0d38b30d-6a67-566c-a32f-bbb91751d7d8", "type": "Country" }, { "__typename": "Country", "aliases": [ "UA", "UKR" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:36:45.074Z", "modified": "2026-04-27T14:34:27.139Z", "updated_at": "2026-04-27T14:34:27.139Z" }, "description_available": false, "entity_type": "Country", "id": "f9d229c5-59ab-4f55-ba05-e4f1bc412969", "is_inferred": false, "labels": [], "lang": "en", "name": "Ukraine", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--fb56af0f-b28e-54d2-b738-6ef5ceb2ce5b", "type": "Country" }, { "__typename": "Country", "aliases": [ "GLP", "GP" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.017Z", "created_at": "2026-01-18T14:36:15.259Z", "modified": "2026-03-10T08:28:29.384Z", "updated_at": "2026-03-10T08:28:29.384Z" }, "description_available": false, "entity_type": "Country", "id": "fa70ab4c-4197-4a53-9dc7-00d90286f3bb", "is_inferred": false, "labels": [], "lang": "en", "name": "Guadeloupe", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--8fecda45-5f6d-5f45-b8eb-0b9958743830", "type": "Country" }, { "__typename": "Country", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 75, "created_by": null, "dates": { "created": "2026-01-18T18:03:12.891Z", "created_at": "2026-01-18T19:12:52.328Z", "modified": "2026-02-06T20:28:49.477Z", "updated_at": "2026-02-06T20:28:49.477Z" }, "description_available": false, "entity_type": "Country", "id": "fc7fcdaa-ff78-412e-94e8-8d3dfe41596f", "is_inferred": false, "labels": [], "lang": "en", "name": "Iran, Islamic Republic of", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--bb2f8544-945a-5b13-9eb1-ca61e364c994", "type": "Country" }, { "__typename": "Country", "aliases": [ "IE", "IRL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.055Z", "created_at": "2026-01-18T14:36:48.124Z", "modified": "2026-01-29T15:55:29.594Z", "updated_at": "2026-01-29T15:55:29.594Z" }, "description_available": false, "entity_type": "Country", "id": "fd027dfd-901a-40e0-a6f4-b2161c2c6e08", "is_inferred": false, "labels": [], "lang": "en", "name": "Ireland", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--2ea6e17c-3542-56f2-a710-d3e2bb7d2de6", "type": "Country" }, { "__typename": "Country", "aliases": [ "CO", "COL" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.028Z", "created_at": "2026-01-18T14:36:22.584Z", "modified": "2026-01-30T18:41:54.693Z", "updated_at": "2026-01-30T18:41:54.693Z" }, "description_available": false, "entity_type": "Country", "id": "fefdf4b3-183f-4689-88e4-bf940937522c", "is_inferred": false, "labels": [], "lang": "en", "name": "Colombia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--478e5e7d-3eb6-59b6-9240-8828a55e8e41", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.674Z", "created_at": "2026-09-26T19:13:13.332Z", "modified": "2026-09-26T19:13:49.547Z", "updated_at": "2026-09-26T19:13:49.547Z" }, "description_available": true, "entity_type": "Indicator", "id": "ff5353df-e61d-4ea6-914a-be71132ee863", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "hygiene", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "indicator--a96a4964-5bdf-5ef2-b364-8dcb18146d25", "type": "Indicator" }, { "__typename": "Country", "aliases": [ "NO", "NOR" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.056Z", "created_at": "2026-01-18T14:36:49.039Z", "modified": "2026-02-06T16:46:58.758Z", "updated_at": "2026-02-06T16:46:58.758Z" }, "description_available": false, "entity_type": "Country", "id": "fff2d669-c6ca-468f-9b4d-3024f03b2d28", "is_inferred": false, "labels": [], "lang": "en", "name": "Norway", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "location--967d1a40-bc85-560a-8937-7b9e5e97a74e", "type": "Country" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.028Z", "created_at": "2026-01-18T14:38:31.671Z", "modified": "2026-01-18T14:38:31.902Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:31.902Z" }, "description_available": true, "entity_type": "located-at", "fromId": "a5ef5419-3010-463a-833d-6e426d1bc636", "from_id": "a5ef5419-3010-463a-833d-6e426d1bc636", "from_name": "Chile", "from_type": "Country", "id": "000f606c-a535-4431-aeb2-b2b43f3fbee9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--fba94fb0-654f-5ccf-b3e1-956f027cd160", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.499Z", "created_at": "2026-09-26T19:14:09.736Z", "modified": "2026-09-26T19:14:09.947Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:09.947Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "04663ba5-183f-4777-ae76-d68ffd717680", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--5096a90b-2c26-5f5d-aa9b-5b8dd988d425", "toId": "e520efd7-16e5-43c4-a14c-17b30bd997f5", "to_id": "e520efd7-16e5-43c4-a14c-17b30bd997f5", "to_name": "Slovakia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.480Z", "created_at": "2026-09-26T19:13:37.461Z", "modified": "2026-09-26T19:13:37.809Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:37.809Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "09dc5ee3-6a14-411c-91c9-f4a518f4b99e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--4dd414b7-a011-5284-9d30-e1482d4f96e4", "toId": "90fc2c57-deea-4c83-9d78-2445ddbc26c7", "to_id": "90fc2c57-deea-4c83-9d78-2445ddbc26c7", "to_name": "Finland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.471Z", "created_at": "2026-09-26T19:13:20.332Z", "modified": "2026-09-26T19:13:20.583Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:20.583Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "0a54da30-8912-43e6-a269-26af72fb4035", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--c1484810-c34f-5c7d-a843-f29e4c80db8b", "toId": "402b2086-638d-4a79-88bb-c79acff485d8", "to_id": "402b2086-638d-4a79-88bb-c79acff485d8", "to_name": "Australia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:39:25.655Z", "modified": "2026-01-18T14:39:25.911Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:25.911Z" }, "description_available": true, "entity_type": "located-at", "fromId": "e520efd7-16e5-43c4-a14c-17b30bd997f5", "from_id": "e520efd7-16e5-43c4-a14c-17b30bd997f5", "from_name": "Slovakia", "from_type": "Country", "id": "0be9efe5-4818-48f1-94cf-29087182f923", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--675a7e86-e1dc-5f35-8350-39504effa4a6", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.490Z", "created_at": "2026-09-26T19:13:56.951Z", "modified": "2026-09-26T19:13:57.398Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:57.398Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "0dc71c00-b55a-41cb-9300-6b776fe3fb92", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9e3d0dad-ab88-56ff-8e32-0abb5e0de586", "toId": "0425dea7-3eb6-4bae-b195-9e5cdac1c15d", "to_id": "0425dea7-3eb6-4bae-b195-9e5cdac1c15d", "to_name": "Malaysia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.671Z", "created_at": "2026-09-26T19:18:27.132Z", "modified": "2026-09-26T19:18:27.581Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:27.581Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e065a43d-e6c0-4fd7-846c-3fe32811b1cc", "from_id": "e065a43d-e6c0-4fd7-846c-3fe32811b1cc", "from_name": null, "from_type": "Indicator", "id": "0e474a13-f1d5-437e-8746-0df8659c9f11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--82a4dd2a-2f53-5c9b-8ba6-500b2183e1aa", "toId": "a490b7df-8b5f-4fb6-8b69-d009e8627d93", "to_id": "a490b7df-8b5f-4fb6-8b69-d009e8627d93", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.489Z", "created_at": "2026-09-26T19:13:56.393Z", "modified": "2026-09-26T19:13:56.547Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:56.547Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "0edea8e5-2342-4b7e-8893-a04e18f1e8f2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--b4358038-1c47-527c-824b-717729d214a1", "toId": "ad3b50f7-baae-44d8-8e10-5fa57a176a2f", "to_id": "ad3b50f7-baae-44d8-8e10-5fa57a176a2f", "to_name": "Madagascar", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:39:49.241Z", "modified": "2026-01-18T14:39:49.677Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:49.677Z" }, "description_available": true, "entity_type": "located-at", "fromId": "489efa86-e1fa-4076-be39-0e9fa106df1c", "from_id": "489efa86-e1fa-4076-be39-0e9fa106df1c", "from_name": "Austria", "from_type": "Country", "id": "1007b47c-f04c-4866-add5-651d440ab223", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--442a4f69-cfeb-5794-b729-e895ad25a32d", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.059Z", "created_at": "2026-01-18T14:39:48.174Z", "modified": "2026-01-18T14:39:48.535Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:48.535Z" }, "description_available": true, "entity_type": "located-at", "fromId": "9c55f3b9-481d-4628-83d3-a6fa22f1b0e3", "from_id": "9c55f3b9-481d-4628-83d3-a6fa22f1b0e3", "from_name": "Portugal", "from_type": "Country", "id": "10563350-ecda-49b5-8079-cb46c256e8d6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2d9fe7fb-4ab2-56cf-ac4d-7f46952a198c", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.499Z", "created_at": "2026-09-26T19:14:26.877Z", "modified": "2026-09-26T19:14:27.034Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:27.034Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "1480b93c-71b9-4b56-b8dd-ed2c662044f3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--002b6898-1518-54a0-b571-ade00e880c3a", "toId": "7ddda560-179a-4ff6-af4e-d6cf5291dd73", "to_id": "7ddda560-179a-4ff6-af4e-d6cf5291dd73", "to_name": "Slovenia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.003Z", "created_at": "2026-01-18T14:37:33.381Z", "modified": "2026-01-18T14:37:33.642Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:33.642Z" }, "description_available": true, "entity_type": "located-at", "fromId": "ad3b50f7-baae-44d8-8e10-5fa57a176a2f", "from_id": "ad3b50f7-baae-44d8-8e10-5fa57a176a2f", "from_name": "Madagascar", "from_type": "Country", "id": "1555fd46-a47f-4db8-a4a9-8ea9ec49b547", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--d46f03d0-a195-53c6-88f4-d51a4c82d477", "toId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_name": "Sub-Saharan Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.027Z", "created_at": "2026-01-18T14:38:30.508Z", "modified": "2026-01-18T14:38:30.805Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:30.805Z" }, "description_available": true, "entity_type": "located-at", "fromId": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "from_id": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "from_name": "Brazil", "from_type": "Country", "id": "15bd6a7d-6175-4ab2-9dfb-812c78752260", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--0b7cf069-836b-5517-8633-51c5ce8069b7", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.669Z", "created_at": "2026-09-26T19:18:27.057Z", "modified": "2026-09-26T19:18:27.356Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:27.356Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d4931a81-8938-4270-ace5-1bad46c5a80c", "from_id": "d4931a81-8938-4270-ace5-1bad46c5a80c", "from_name": null, "from_type": "Indicator", "id": "1728310a-ee96-4ac3-b123-629f2301406b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a87999e9-6af8-551b-baf1-554b95a8306c", "toId": "e93697ef-3aa1-41ea-92f9-eccd0b471766", "to_id": "e93697ef-3aa1-41ea-92f9-eccd0b471766", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.486Z", "created_at": "2026-09-26T19:13:47.751Z", "modified": "2026-09-26T19:13:48.065Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:48.065Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "17b714d5-2212-4b76-a5e5-b8a51a859d73", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2b29c495-238d-53f5-bc69-b55eb7358957", "toId": "fd027dfd-901a-40e0-a6f4-b2161c2c6e08", "to_id": "fd027dfd-901a-40e0-a6f4-b2161c2c6e08", "to_name": "Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.472Z", "created_at": "2026-09-26T19:13:20.917Z", "modified": "2026-09-26T19:13:21.190Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:21.190Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "18bc6443-688f-44bd-a57e-63745864f58d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--cbdd6af8-9520-57b9-88a6-bc95abf26ad8", "toId": "f4193c66-63e1-4298-a814-205542e00106", "to_id": "f4193c66-63e1-4298-a814-205542e00106", "to_name": "Belarus", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.044Z", "created_at": "2026-01-18T14:39:00.892Z", "modified": "2026-01-18T14:39:01.182Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:01.182Z" }, "description_available": true, "entity_type": "located-at", "fromId": "6926835d-28e0-4787-97c9-699d0375b12b", "from_id": "6926835d-28e0-4787-97c9-699d0375b12b", "from_name": "India", "from_type": "Country", "id": "1943dcbb-b312-436e-873f-c3cef811d6bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--f7bc8131-8473-5cdd-9b6d-660635e5d317", "toId": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_name": "Southern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.478Z", "created_at": "2026-09-26T19:13:33.475Z", "modified": "2026-09-26T19:13:33.732Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:33.732Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "1a4b3750-c569-497d-b050-b3f6785ddff1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--add5b8a7-3edd-5087-873e-fa80987d234f", "toId": "91a251e1-43ba-49df-87da-035fd51e1e02", "to_id": "91a251e1-43ba-49df-87da-035fd51e1e02", "to_name": "Czechia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:37:59.735Z", "modified": "2026-01-18T14:38:00.115Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:00.115Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "from_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "from_name": "Latin America and the Caribbean", "from_type": "Region", "id": "1a7e18bf-4118-4428-bb9d-d97927778771", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--333d7612-4184-5ace-a7eb-618c9acd457a", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.486Z", "created_at": "2026-09-26T19:13:48.657Z", "modified": "2026-09-26T19:13:48.893Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:48.893Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "1b03426b-92f9-460b-924c-2915e414986a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--286a88da-ed0d-5d34-80b8-da68094abece", "toId": "c4740bb7-1852-488f-935a-7ac938329773", "to_id": "c4740bb7-1852-488f-935a-7ac938329773", "to_name": "Italy", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.494Z", "created_at": "2026-09-26T19:14:02.765Z", "modified": "2026-09-26T19:14:03.090Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:03.090Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "1d339e91-7f7d-4fb5-91d6-01eb3e2b7c9b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--67c664aa-724c-5170-8442-8c64af766231", "toId": "fff2d669-c6ca-468f-9b4d-3024f03b2d28", "to_id": "fff2d669-c6ca-468f-9b4d-3024f03b2d28", "to_name": "Norway", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.501Z", "created_at": "2026-09-26T19:14:11.179Z", "modified": "2026-09-26T19:14:11.431Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:11.431Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "25193364-c5c8-40a0-8808-1fe094986557", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--667f42d5-9bfe-56b8-bbfa-b7e498959874", "toId": "7a72cd9d-d02d-4dae-918b-53a544cea49f", "to_id": "7a72cd9d-d02d-4dae-918b-53a544cea49f", "to_name": "Sweden", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:37:23.973Z", "modified": "2026-01-18T14:37:24.172Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:24.172Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "from_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "from_name": "British Indian Ocean Territory", "from_type": "Country", "id": "2583270a-b17f-4374-9d91-f191ee3f1eb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1ac96288-b57b-5204-a37b-5e60317969a7", "toId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_name": "Sub-Saharan Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:39:52.934Z", "modified": "2026-01-18T14:39:53.286Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:53.286Z" }, "description_available": true, "entity_type": "located-at", "fromId": "39c8e739-b7f2-4a6c-bea0-facfb73d6cd9", "from_id": "39c8e739-b7f2-4a6c-bea0-facfb73d6cd9", "from_name": "Monaco", "from_type": "Country", "id": "26b78b48-7456-401b-bcf4-6155ab39fe32", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1d797b7c-f45c-5700-8634-e5bc3ace3b07", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.712Z", "created_at": "2026-09-26T19:19:07.942Z", "modified": "2026-09-26T19:19:08.280Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:19:08.280Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e065a43d-e6c0-4fd7-846c-3fe32811b1cc", "from_id": "e065a43d-e6c0-4fd7-846c-3fe32811b1cc", "from_name": null, "from_type": "Indicator", "id": "29cf4226-25f2-441c-af49-15119f6ae95a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--6fd70e2d-4440-5512-9b2a-a5d4be54e242", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.521Z", "created_at": "2026-09-26T19:14:33.303Z", "modified": "2026-09-26T19:14:33.743Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:33.743Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "2bf4f906-24a5-4586-902d-1e55822208f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1d240704-b846-5822-81ef-425b049adff1", "toId": "4f275781-30af-4e1e-affa-090a4b6c7f16", "to_id": "4f275781-30af-4e1e-affa-090a4b6c7f16", "to_name": "CVE-2026-63030", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.483Z", "created_at": "2026-09-26T19:13:41.072Z", "modified": "2026-09-26T19:13:41.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:41.375Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "2e0fc0ae-e047-46f2-8fcc-4c7acb7e6b4d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e6742f79-a986-5714-b627-90847430bf44", "toId": "a546f442-556c-4599-b76b-874caeb6aaf2", "to_id": "a546f442-556c-4599-b76b-874caeb6aaf2", "to_name": "Hong Kong", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.666Z", "created_at": "2026-09-26T19:18:26.626Z", "modified": "2026-09-26T19:18:26.756Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:26.756Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5a1c6344-c106-4956-bee5-835d59bbd9a1", "from_id": "5a1c6344-c106-4956-bee5-835d59bbd9a1", "from_name": null, "from_type": "Indicator", "id": "2ed48013-6875-44bf-bc62-c7a6796cde9a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--5e18233c-b3e0-5969-9e1d-c473c47dee6e", "toId": "8080812d-ede9-4e6e-91f1-bdaabe508538", "to_id": "8080812d-ede9-4e6e-91f1-bdaabe508538", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:39:54.991Z", "modified": "2026-01-18T14:39:56.326Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:56.326Z" }, "description_available": true, "entity_type": "located-at", "fromId": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "from_id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "from_name": "Netherlands", "from_type": "Country", "id": "2f9b2aa4-c4d8-4d14-8ddb-071a4e9c9033", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--63fbac78-03f5-5507-9258-6bf1d7182295", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.523Z", "created_at": "2026-09-26T19:14:37.853Z", "modified": "2026-09-26T19:14:38.106Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:38.106Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "2fd5b6ec-9cd7-4006-b2d0-9af09411e279", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--67dd1273-0bed-5876-8fef-c8f0086625e7", "toId": "c26b89cd-81e5-4d81-b9e5-59dc7ebb0e7a", "to_id": "c26b89cd-81e5-4d81-b9e5-59dc7ebb0e7a", "to_name": "CVE-2026-56271", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.010Z", "created_at": "2026-01-18T14:37:51.481Z", "modified": "2026-01-18T14:37:51.778Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:51.778Z" }, "description_available": true, "entity_type": "located-at", "fromId": "204e3ce5-7698-48bd-a847-07922b85ff44", "from_id": "204e3ce5-7698-48bd-a847-07922b85ff44", "from_name": "South Africa", "from_type": "Country", "id": "305eb8e0-fcd2-48d1-87a9-b4247f61819d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--8f714292-568e-5ba2-b367-1044471d37c9", "toId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "to_name": "Sub-Saharan Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.479Z", "created_at": "2026-09-26T19:13:36.020Z", "modified": "2026-09-26T19:13:36.263Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:36.263Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "358458b4-130f-4a65-afed-080c32cd0b76", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9eae8961-7ef5-5242-b76c-ab20159fc63d", "toId": "94b2604c-63f0-4cb3-bcef-f2f82109b72a", "to_id": "94b2604c-63f0-4cb3-bcef-f2f82109b72a", "to_name": "Denmark", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:38:45.837Z", "modified": "2026-01-18T14:38:46.067Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:46.067Z" }, "description_available": true, "entity_type": "located-at", "fromId": "d91d9170-3c76-4158-9559-2db658404d55", "from_id": "d91d9170-3c76-4158-9559-2db658404d55", "from_name": "China", "from_type": "Country", "id": "35aa4cc9-68bf-4356-9a53-6e579d086a3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--702b6c48-2778-5704-9f96-6aa60365352f", "toId": "5e22af61-1616-46dc-b076-551e7f99593f", "to_id": "5e22af61-1616-46dc-b076-551e7f99593f", "to_name": "Eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.017Z", "created_at": "2026-01-18T14:38:12.554Z", "modified": "2026-01-18T14:38:12.784Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:12.784Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2598896d-b4e0-4301-b370-a40eb7e5d70e", "from_id": "2598896d-b4e0-4301-b370-a40eb7e5d70e", "from_name": "Martinique", "from_type": "Country", "id": "36e79ffe-05fc-4b8b-8a0e-7e87b3b8e250", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2a7a31d6-83f9-500b-9668-bfaf6de3138e", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:39:38.323Z", "modified": "2026-01-18T14:39:38.509Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:38.509Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "from_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "from_name": "United Kingdom of Great Britain and Northern Ireland", "from_type": "Country", "id": "384f404b-1b13-4e2c-b360-ef51feb026c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e3cb58c7-3ba5-5f88-b0a8-b69046948322", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.037Z", "created_at": "2026-01-18T14:38:44.509Z", "modified": "2026-01-18T14:38:44.724Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:44.724Z" }, "description_available": true, "entity_type": "located-at", "fromId": "48234104-26a2-456c-9996-47333cb1ea79", "from_id": "48234104-26a2-456c-9996-47333cb1ea79", "from_name": "Uzbekistan", "from_type": "Country", "id": "3d06beb9-4123-4948-89b0-9aae92eb2b6c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--803eb9c5-2b85-590d-9487-81ec3e7dd2b1", "toId": "765d7d4d-7684-440b-bbcd-4037047b7699", "to_id": "765d7d4d-7684-440b-bbcd-4037047b7699", "to_name": "Central Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.495Z", "created_at": "2026-09-26T19:14:04.601Z", "modified": "2026-09-26T19:14:04.865Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:04.865Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "3efff502-d5d9-46a2-b01e-a001820cd1ad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1a90a736-7a4c-522b-bb3a-9270b788db38", "toId": "37b0f937-8e43-404b-8120-dd53e54102b0", "to_id": "37b0f937-8e43-404b-8120-dd53e54102b0", "to_name": "Panama", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.519Z", "created_at": "2026-09-26T19:14:26.478Z", "modified": "2026-09-26T19:14:26.643Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:26.643Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "404423b9-ec6b-4492-93f3-07c9e52fc0eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2ddbe538-bb25-5a8a-9afe-8945b7b76d0f", "toId": "6bf00d62-0c1f-4ab6-a2b6-a0ea715efb88", "to_id": "6bf00d62-0c1f-4ab6-a2b6-a0ea715efb88", "to_name": "CVE-2026-34908", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.745Z", "created_at": "2026-09-26T19:19:49.423Z", "modified": "2026-09-26T19:19:49.613Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:19:49.613Z" }, "description_available": false, "entity_type": "indicates", "fromId": "98534320-ab7e-49ba-b595-7ce86071ff23", "from_id": "98534320-ab7e-49ba-b595-7ce86071ff23", "from_name": null, "from_type": "Indicator", "id": "406be2a9-1ad2-4d5c-911a-93d6c29e5cf0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--6ae55842-b1e0-55cc-8ec3-04548cf94c8d", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.519Z", "created_at": "2026-09-26T19:14:35.437Z", "modified": "2026-09-26T19:14:35.570Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:35.570Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "4271469c-f1a2-42c8-b43c-871eaef2060b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a3d10194-b9a9-5277-b43f-635bc49710fb", "toId": "248a7566-ed41-4b3d-9727-3c7b60880f1b", "to_id": "248a7566-ed41-4b3d-9727-3c7b60880f1b", "to_name": "CVE-2026-34909", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:39:48.201Z", "modified": "2026-01-18T14:39:48.601Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:48.601Z" }, "description_available": true, "entity_type": "located-at", "fromId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "from_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "from_name": "Western Europe", "from_type": "Region", "id": "42e7a8d1-4ff2-49b2-8955-e523f876fd14", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a8c89c99-5dee-56fe-ab02-c5269d6a6624", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.475Z", "created_at": "2026-09-26T19:13:25.877Z", "modified": "2026-09-26T19:13:26.034Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:26.034Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "4600a57c-1705-4691-864c-42c246250820", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--5662ba28-c9d4-5b83-a15f-c934c6f84eeb", "toId": "a5ef5419-3010-463a-833d-6e426d1bc636", "to_id": "a5ef5419-3010-463a-833d-6e426d1bc636", "to_name": "Chile", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.042Z", "created_at": "2026-01-18T14:38:57.676Z", "modified": "2026-01-18T14:38:58.321Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:58.321Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0bd2f670-947a-490e-86a7-8ad5b775cb17", "from_id": "0bd2f670-947a-490e-86a7-8ad5b775cb17", "from_name": "Philippines", "from_type": "Country", "id": "46bcb22e-e767-473f-9244-40b1186cdf4d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a51d1513-28c5-5b27-a2a9-5c23398154cf", "toId": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_name": "South-eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:39:47.006Z", "modified": "2026-01-18T14:39:47.220Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:47.220Z" }, "description_available": true, "entity_type": "located-at", "fromId": "7ddda560-179a-4ff6-af4e-d6cf5291dd73", "from_id": "7ddda560-179a-4ff6-af4e-d6cf5291dd73", "from_name": "Slovenia", "from_type": "Country", "id": "46e86eaa-1923-4f34-8e16-a439e558b430", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--6d99bde4-fa85-5e46-8915-5067ddb85bcc", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:38:39.061Z", "modified": "2026-01-18T14:38:39.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:39.335Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_name": "Northern America", "from_type": "Region", "id": "4a3ffcd5-bd03-47c6-a71d-4c47c1151811", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--35fa17bc-cd76-5e88-b582-d1c577aa86ba", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:39:38.396Z", "modified": "2026-01-18T14:39:38.694Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:38.694Z" }, "description_available": true, "entity_type": "located-at", "fromId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "from_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "from_name": "Southern Europe", "from_type": "Region", "id": "4a4ab3f0-da20-43c5-9cef-24ebe8bbf656", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--b8e30f57-1b31-5a56-85c4-71dfc9e4f62a", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.501Z", "created_at": "2026-09-26T19:14:10.751Z", "modified": "2026-09-26T19:14:10.948Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:10.948Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "4b6311ee-16d0-4ea0-bc14-16193a86e84a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a0ef1293-d000-5b03-9c32-c40c08c00020", "toId": "6d717ddf-b5e6-4c07-9b16-ba739399f54a", "to_id": "6d717ddf-b5e6-4c07-9b16-ba739399f54a", "to_name": "Spain", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.482Z", "created_at": "2026-09-26T19:13:51.051Z", "modified": "2026-09-26T19:13:51.446Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:51.446Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "4df2d45d-b925-4c51-90ca-7173273859f2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e676f66f-612a-57fd-9ccc-00ef696e5500", "toId": "fa70ab4c-4197-4a53-9dc7-00d90286f3bb", "to_id": "fa70ab4c-4197-4a53-9dc7-00d90286f3bb", "to_name": "Guadeloupe", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.490Z", "created_at": "2026-09-26T19:13:59.115Z", "modified": "2026-09-26T19:13:59.541Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:59.541Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "4f12bcd7-2e5e-42f7-a8db-f6959e0c7275", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--db398dcc-b0d1-5be6-990d-bc815e717615", "toId": "07cbe900-6e4d-4c1e-8ac0-85a6000ba707", "to_id": "07cbe900-6e4d-4c1e-8ac0-85a6000ba707", "to_name": "Malta", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:39:51.573Z", "modified": "2026-01-18T14:39:51.848Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:51.848Z" }, "description_available": true, "entity_type": "located-at", "fromId": "28acec63-0804-49d2-95fa-8beb12f12b33", "from_id": "28acec63-0804-49d2-95fa-8beb12f12b33", "from_name": "France", "from_type": "Country", "id": "55355b78-b31e-4a4d-902e-2ad5aa324f55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--5e1293d5-a319-5fe8-b3b9-dc5550bb674e", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.498Z", "created_at": "2026-09-26T19:14:08.242Z", "modified": "2026-09-26T19:14:08.457Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:08.457Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "56908e73-8440-4fff-872e-7adecbfd1f71", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e0ef5799-b0cb-5f43-bba3-9842ce88ccd1", "toId": "aad12288-fa3e-4395-a8a0-3c83fd8f0b9f", "to_id": "aad12288-fa3e-4395-a8a0-3c83fd8f0b9f", "to_name": "Romania", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.485Z", "created_at": "2026-09-26T19:13:45.783Z", "modified": "2026-09-26T19:13:45.929Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:45.929Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "5736a512-3d0f-4e95-94a8-d8524cfc24e1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--124ffd03-e0b9-5a1e-bef8-f3e9596c820a", "toId": "6926835d-28e0-4787-97c9-699d0375b12b", "to_id": "6926835d-28e0-4787-97c9-699d0375b12b", "to_name": "India", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.522Z", "created_at": "2026-09-26T19:14:34.713Z", "modified": "2026-09-26T19:14:35.019Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:35.019Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "59ace58f-e6bc-46ac-968d-2e621cd82f3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--4522705c-d98d-5482-a925-d052b6546325", "toId": "453ee776-b61e-4171-8009-fc5407da6913", "to_id": "453ee776-b61e-4171-8009-fc5407da6913", "to_name": "CVE-2023-54391", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.723Z", "created_at": "2026-09-26T07:06:57.034Z", "modified": "2026-09-26T07:06:57.271Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:57.271Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "5d5edf46-580f-4ddc-9714-d47dd3d11a32", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--00015eca-5ecc-515a-98bb-1d89bf0b86ae", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.049Z", "created_at": "2026-01-18T14:39:15.857Z", "modified": "2026-01-18T14:39:16.715Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:16.715Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c8d88472-f56e-445a-be11-f5c5b2794ac4", "from_id": "c8d88472-f56e-445a-be11-f5c5b2794ac4", "from_name": "United Arab Emirates", "from_type": "Country", "id": "5fafb211-62df-44ba-aca8-31096fd33014", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--d4469ae5-5f24-556b-ac70-1ed2fd06324b", "toId": "83ee16e7-a32f-4c97-ab6a-627957b0b061", "to_id": "83ee16e7-a32f-4c97-ab6a-627957b0b061", "to_name": "Middle East", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.505Z", "created_at": "2026-09-26T19:14:13.861Z", "modified": "2026-09-26T19:14:14.025Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:14.025Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "63df2d24-1df9-4915-a389-251f5578f1ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--64b50428-770c-5717-9b9d-6d03647e8c72", "toId": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_id": "f2fc791f-b777-4d8f-87a6-5e87abeec776", "to_name": "United Kingdom of Great Britain and Northern Ireland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.678Z", "created_at": "2026-09-26T19:18:28.315Z", "modified": "2026-09-26T19:18:28.850Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:28.850Z" }, "description_available": false, "entity_type": "based-on", "fromId": "98534320-ab7e-49ba-b595-7ce86071ff23", "from_id": "98534320-ab7e-49ba-b595-7ce86071ff23", "from_name": null, "from_type": "Indicator", "id": "650f789b-f8f5-49ec-acd8-75421f4ce85d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--7e504a60-d10d-5fb6-8cb0-5395c58292a3", "toId": "a4cb6aeb-a168-49c6-a895-c2354fe94740", "to_id": "a4cb6aeb-a168-49c6-a895-c2354fe94740", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:39:26.810Z", "modified": "2026-01-18T14:39:27.271Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:27.271Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f9d229c5-59ab-4f55-ba05-e4f1bc412969", "from_id": "f9d229c5-59ab-4f55-ba05-e4f1bc412969", "from_name": "Ukraine", "from_type": "Country", "id": "654c4b81-e446-4313-b36c-2b03252f5bc7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--fca0590d-fbd3-58ed-b1e4-28ccb7d3029c", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.059Z", "created_at": "2026-01-18T14:39:42.638Z", "modified": "2026-01-18T14:39:42.869Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:42.869Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c4740bb7-1852-488f-935a-7ac938329773", "from_id": "c4740bb7-1852-488f-935a-7ac938329773", "from_name": "Italy", "from_type": "Country", "id": "660538fe-4f60-4d0b-8229-30b49865088b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--c2d18b12-1857-5c6d-8398-d13be81ae366", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.473Z", "created_at": "2026-09-26T19:13:21.886Z", "modified": "2026-09-26T19:13:22.221Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:22.221Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "673c2877-92d4-4372-8bf6-6a566989047d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--d6884571-f371-5efb-9ff3-7f1f87586a26", "toId": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "to_id": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "to_name": "Belgium", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:38:42.143Z", "modified": "2026-01-18T14:38:42.537Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:42.537Z" }, "description_available": true, "entity_type": "located-at", "fromId": "765d7d4d-7684-440b-bbcd-4037047b7699", "from_id": "765d7d4d-7684-440b-bbcd-4037047b7699", "from_name": "Central Asia", "from_type": "Region", "id": "6989091f-a460-4a50-ae48-83305ee4e096", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--3be20a01-54d5-5a1e-a05e-e9c4ee624f4d", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.045Z", "created_at": "2026-01-18T14:39:04.926Z", "modified": "2026-01-18T14:39:05.266Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:05.266Z" }, "description_available": true, "entity_type": "located-at", "fromId": "83ee16e7-a32f-4c97-ab6a-627957b0b061", "from_id": "83ee16e7-a32f-4c97-ab6a-627957b0b061", "from_name": "Middle East", "from_type": "Region", "id": "6aa06a6a-7336-4725-911f-09949d3abd74", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1e4d5dfa-9204-5e47-b8a1-ef46a70d7cab", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.491Z", "created_at": "2026-09-26T19:14:01.279Z", "modified": "2026-09-26T19:14:01.448Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:01.448Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "6b9cf8a9-e428-4e52-b075-f61f38f46afc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e160d433-9599-5447-85a6-39059eb679a1", "toId": "2598896d-b4e0-4301-b370-a40eb7e5d70e", "to_id": "2598896d-b4e0-4301-b370-a40eb7e5d70e", "to_name": "Martinique", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.484Z", "created_at": "2026-09-26T19:14:00.245Z", "modified": "2026-09-26T19:14:00.614Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:00.614Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "6cb7ced8-da58-4f66-82e7-12d18d2c23dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--b2cb2de0-4b5d-53d9-a0e2-88525d5b5673", "toId": "55aa32ee-212e-4703-b538-80e0de523755", "to_id": "55aa32ee-212e-4703-b538-80e0de523755", "to_name": "Hungary", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:39:19.018Z", "modified": "2026-01-18T14:39:19.710Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:19.710Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "from_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "from_name": "Eastern Europe", "from_type": "Region", "id": "6dae7889-c931-4182-be78-1c7cd2b70dd8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--20f37797-8c45-548e-996f-36884bf9bca9", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.056Z", "created_at": "2026-01-18T14:39:35.421Z", "modified": "2026-01-18T14:39:35.620Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:35.620Z" }, "description_available": true, "entity_type": "located-at", "fromId": "89d766a1-976e-4d7c-8523-f2bdc6ac0c9f", "from_id": "89d766a1-976e-4d7c-8523-f2bdc6ac0c9f", "from_name": "Lithuania", "from_type": "Country", "id": "6f1f5fe9-1ca3-4e6e-953f-3cd302f052b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--badc5756-e7ed-5b8c-8cc3-3fc00f8dffc4", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.701Z", "created_at": "2026-09-26T19:18:54.740Z", "modified": "2026-09-26T19:18:54.928Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:54.928Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4931a81-8938-4270-ace5-1bad46c5a80c", "from_id": "d4931a81-8938-4270-ace5-1bad46c5a80c", "from_name": null, "from_type": "Indicator", "id": "6fe86595-95c2-477e-b9ed-f641e4ff80fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--595564d6-4b44-5ba0-85a3-778d86e834a1", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.679Z", "created_at": "2026-09-26T19:18:28.562Z", "modified": "2026-09-26T19:18:29.297Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:29.297Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7def13ab-2ef4-4447-be92-6ca0d91c791c", "from_id": "7def13ab-2ef4-4447-be92-6ca0d91c791c", "from_name": null, "from_type": "Indicator", "id": "6ff4557b-49ba-4666-bd21-8fd30ebdb373", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9709cf33-d6ee-5780-8463-db628e7eec45", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.488Z", "created_at": "2026-09-26T19:14:06.874Z", "modified": "2026-09-26T19:14:07.229Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:07.229Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "7083dbaa-9b6a-4a03-a5b9-77148533163e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--79d25fc6-512b-50bb-9135-d41654d691b9", "toId": "89d766a1-976e-4d7c-8523-f2bdc6ac0c9f", "to_id": "89d766a1-976e-4d7c-8523-f2bdc6ac0c9f", "to_name": "Lithuania", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.503Z", "created_at": "2026-09-26T19:14:19.790Z", "modified": "2026-09-26T19:14:20.102Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:20.102Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "7661456b-2dcd-4c04-beff-30e169ff2866", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--25ce8aa7-56ef-57ad-a368-d5b71e07cdd0", "toId": "44f005d1-ae5e-4d44-99e6-a75203662d2d", "to_id": "44f005d1-ae5e-4d44-99e6-a75203662d2d", "to_name": "Taiwan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.055Z", "created_at": "2026-01-18T14:39:34.196Z", "modified": "2026-01-18T14:39:34.446Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:34.446Z" }, "description_available": true, "entity_type": "located-at", "fromId": "fd027dfd-901a-40e0-a6f4-b2161c2c6e08", "from_id": "fd027dfd-901a-40e0-a6f4-b2161c2c6e08", "from_name": "Ireland", "from_type": "Country", "id": "773a7a12-3a24-4bbb-a1ff-b5cc01221b9f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--c728fd34-3ae0-5282-bda6-80672a86dc33", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.026Z", "created_at": "2026-01-18T14:38:27.685Z", "modified": "2026-01-18T14:38:28.076Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:28.076Z" }, "description_available": true, "entity_type": "located-at", "fromId": "37b0f937-8e43-404b-8120-dd53e54102b0", "from_id": "37b0f937-8e43-404b-8120-dd53e54102b0", "from_name": "Panama", "from_type": "Country", "id": "774398c9-1f2a-47e4-baf7-eca8916e113d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--f9b2dcc4-dadb-5cb6-b66c-0a52553cb478", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:39:54.345Z", "modified": "2026-01-18T14:39:54.701Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:54.701Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2730372a-ef6c-4210-bc27-805102dc639f", "from_id": "2730372a-ef6c-4210-bc27-805102dc639f", "from_name": "Australia and New Zealand", "from_type": "Region", "id": "7abe29ae-6c1f-49ff-866a-69f3404f3cc3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2ad84e60-8fdf-53b7-9240-b55c5bacdb59", "toId": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "to_id": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "to_name": "Oceania", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.481Z", "created_at": "2026-09-26T19:13:38.765Z", "modified": "2026-09-26T19:13:39.462Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:39.462Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "7ac16cd0-4b2f-4c7e-b4d7-f3e9743e6782", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9ce1fa13-e539-5c2f-bf7d-1d40cd2c5663", "toId": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "to_name": "Germany", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.488Z", "created_at": "2026-09-26T19:13:51.931Z", "modified": "2026-09-26T19:13:53.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:53.348Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "7e467f93-dfb9-4321-97bc-8aa9ab7e9aa1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--70a9a3de-9f3c-571c-b1f5-60981dbcb080", "toId": "f3521355-05dc-4951-b97e-0fa007cf66f3", "to_id": "f3521355-05dc-4951-b97e-0fa007cf66f3", "to_name": "Latvia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.492Z", "created_at": "2026-09-26T19:14:02.336Z", "modified": "2026-09-26T19:14:02.489Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:02.489Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "7edcd174-b2ba-4093-9fb6-47d2e980f3d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--dbdd6f64-9524-563e-958d-b0d9a9c35428", "toId": "4b29d74f-fe60-4f8a-a211-324ea1a572fa", "to_id": "4b29d74f-fe60-4f8a-a211-324ea1a572fa", "to_name": "Mongolia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.474Z", "created_at": "2026-09-26T19:13:22.685Z", "modified": "2026-09-26T19:13:22.948Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:22.948Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "80283e88-1dd7-46a7-bab5-4caed1c68852", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--66040fa8-f090-5d78-8c01-5d42e1f18976", "toId": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "to_id": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "to_name": "Brazil", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:39:26.169Z", "modified": "2026-01-18T14:39:26.421Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:26.421Z" }, "description_available": true, "entity_type": "located-at", "fromId": "45ceffa5-90ff-48b8-b920-1d211baf5981", "from_id": "45ceffa5-90ff-48b8-b920-1d211baf5981", "from_name": "Poland", "from_type": "Country", "id": "8106db77-abbb-4f17-96b2-6e4d9d66c7c3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1cf85625-de1f-5830-ad13-ab5bcc4801fd", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.502Z", "created_at": "2026-09-26T19:14:11.623Z", "modified": "2026-09-26T19:14:11.825Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:11.825Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "8431ed09-f275-4c09-a1cc-dd22223e3478", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--135b7c90-9231-579b-99f3-ab2f75b9ebc7", "toId": "8a198689-d83f-46bd-98c3-a2f76adae719", "to_id": "8a198689-d83f-46bd-98c3-a2f76adae719", "to_name": "Switzerland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.518Z", "created_at": "2026-09-26T19:14:25.619Z", "modified": "2026-09-26T19:14:26.102Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:26.102Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "855895aa-c6c1-49e9-8a11-aa39e71d59ff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--296f006f-d1d0-5440-8e83-986cf89447d9", "toId": "32a5d6cf-94de-41cb-93a4-f1535d89cf14", "to_id": "32a5d6cf-94de-41cb-93a4-f1535d89cf14", "to_name": "CVE-2022-0847", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.055Z", "created_at": "2026-01-18T14:39:32.352Z", "modified": "2026-01-18T14:39:32.672Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:32.672Z" }, "description_available": true, "entity_type": "located-at", "fromId": "a5f4f35e-0f44-4b6f-858b-931d9a747f20", "from_id": "a5f4f35e-0f44-4b6f-858b-931d9a747f20", "from_name": "Iceland", "from_type": "Country", "id": "86c71d37-c55a-4fbe-852c-f4b5a613537c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--6ba54f93-218e-5a81-9bc2-f478fd5810e4", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:39:20.046Z", "modified": "2026-01-18T14:39:20.248Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:20.248Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f4193c66-63e1-4298-a814-205542e00106", "from_id": "f4193c66-63e1-4298-a814-205542e00106", "from_name": "Belarus", "from_type": "Country", "id": "8b192ce5-d1c6-497a-99dc-eff06bebbbd5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--fb34376c-0f2c-576c-8257-d5d316abfdee", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:39:20.641Z", "modified": "2026-01-18T14:39:20.880Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:20.880Z" }, "description_available": true, "entity_type": "located-at", "fromId": "91a251e1-43ba-49df-87da-035fd51e1e02", "from_id": "91a251e1-43ba-49df-87da-035fd51e1e02", "from_name": "Czechia", "from_type": "Country", "id": "8b302db9-0d5a-4915-862f-729040076546", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--168fa1e1-888c-5f40-b49b-e34844366834", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.506Z", "created_at": "2026-09-26T19:14:14.445Z", "modified": "2026-09-26T19:14:14.616Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:14.616Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "8b64307d-97a6-40f3-a8c7-7d6db0399e95", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--fb8b37a9-6b49-5d65-a2bb-cdc24ce92338", "toId": "48234104-26a2-456c-9996-47333cb1ea79", "to_id": "48234104-26a2-456c-9996-47333cb1ea79", "to_name": "Uzbekistan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:39:50.056Z", "modified": "2026-01-18T14:39:50.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:50.352Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "from_id": "c31973cc-3fba-4e06-8ae7-41954e92d90f", "from_name": "Germany", "from_type": "Country", "id": "8da103a4-5a81-4add-8d86-382e44dc00b0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e82eefa3-aa16-545f-9d62-41ae0db89bde", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:38:45.161Z", "modified": "2026-01-18T14:38:45.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:45.423Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5e22af61-1616-46dc-b076-551e7f99593f", "from_id": "5e22af61-1616-46dc-b076-551e7f99593f", "from_name": "Eastern Asia", "from_type": "Region", "id": "91530847-808e-41e5-ba46-b862b581cb23", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--272b6dd8-e726-5eb2-9db7-c27916944d0f", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.054Z", "created_at": "2026-01-18T14:39:30.585Z", "modified": "2026-01-18T14:39:30.865Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:30.865Z" }, "description_available": true, "entity_type": "located-at", "fromId": "59722221-e14e-4a05-ab01-f9f7c9fc83ab", "from_id": "59722221-e14e-4a05-ab01-f9f7c9fc83ab", "from_name": "Estonia", "from_type": "Country", "id": "92b012b7-3d4c-4f96-a787-08a7aa777ec1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--bca9f594-6c60-5784-a1a3-fc15211c8d90", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:39:27.774Z", "modified": "2026-01-18T14:39:28.227Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:28.227Z" }, "description_available": true, "entity_type": "located-at", "fromId": "aad12288-fa3e-4395-a8a0-3c83fd8f0b9f", "from_id": "aad12288-fa3e-4395-a8a0-3c83fd8f0b9f", "from_name": "Romania", "from_type": "Country", "id": "93659557-b85a-42a3-8876-8a5c68d44270", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1488f6ac-2373-5bc9-940d-ecd9cbf8f1ba", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:38:55.934Z", "modified": "2026-01-18T14:38:56.134Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:56.134Z" }, "description_available": true, "entity_type": "located-at", "fromId": "bbba6d60-0079-4957-bb12-8e1c8f03a5c9", "from_id": "bbba6d60-0079-4957-bb12-8e1c8f03a5c9", "from_name": "Thailand", "from_type": "Country", "id": "9389cf87-4817-4cda-adfc-3882050a682d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--b49b5ef6-0370-5080-b0f4-7ea87c5daae0", "toId": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_name": "South-eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.041Z", "created_at": "2026-01-18T14:38:50.130Z", "modified": "2026-01-18T14:38:50.445Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:50.445Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "from_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "from_name": "South-eastern Asia", "from_type": "Region", "id": "9529f873-617d-4b0d-bc48-1d06ac3d427d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--57b88036-b8b8-5d8e-81c8-ae50acdd7638", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.054Z", "created_at": "2026-01-18T14:39:31.735Z", "modified": "2026-01-18T14:39:32.023Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:32.023Z" }, "description_available": true, "entity_type": "located-at", "fromId": "94b2604c-63f0-4cb3-bcef-f2f82109b72a", "from_id": "94b2604c-63f0-4cb3-bcef-f2f82109b72a", "from_name": "Denmark", "from_type": "Country", "id": "96709a1d-5988-43aa-a54b-97845f088a67", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--0894d470-d163-5689-8851-89a42f6320e0", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:39:37.201Z", "modified": "2026-01-18T14:39:37.441Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:37.441Z" }, "description_available": true, "entity_type": "located-at", "fromId": "7a72cd9d-d02d-4dae-918b-53a544cea49f", "from_id": "7a72cd9d-d02d-4dae-918b-53a544cea49f", "from_name": "Sweden", "from_type": "Country", "id": "96f14c72-0815-4c61-8cdd-5c8d37ed6ef0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e1bb9961-b4bf-5d3f-be00-be48032f6079", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.673Z", "created_at": "2026-09-26T19:18:27.373Z", "modified": "2026-09-26T19:18:27.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:27.841Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c9fb0937-5fb3-45a2-9d1a-09f04c80c2a5", "from_id": "c9fb0937-5fb3-45a2-9d1a-09f04c80c2a5", "from_name": null, "from_type": "Indicator", "id": "984df3b9-e1df-4d63-864e-a8659fd5113d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a46e3622-03f6-5bcb-b88f-7461a0b4f4f4", "toId": "e3a7a02f-4e1f-4821-8dba-91ac842e9015", "to_id": "e3a7a02f-4e1f-4821-8dba-91ac842e9015", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.690Z", "created_at": "2026-09-26T19:18:39.952Z", "modified": "2026-09-26T19:18:40.158Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:40.158Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5a1c6344-c106-4956-bee5-835d59bbd9a1", "from_id": "5a1c6344-c106-4956-bee5-835d59bbd9a1", "from_name": null, "from_type": "Indicator", "id": "9a62ce2c-1606-4e45-b38c-91654cc87b19", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--5a36888e-efe4-5d67-9875-05e43b874616", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.496Z", "created_at": "2026-09-26T19:14:12.050Z", "modified": "2026-09-26T19:14:12.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:12.352Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "9ad97a07-f551-49c6-b931-66b0d336a552", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--266abe9d-8817-58b9-ac9a-f7d66598e7f3", "toId": "45ceffa5-90ff-48b8-b920-1d211baf5981", "to_id": "45ceffa5-90ff-48b8-b920-1d211baf5981", "to_name": "Poland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.720Z", "created_at": "2026-09-26T07:06:54.274Z", "modified": "2026-09-26T07:06:54.514Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:54.514Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "9dd0ebe2-2b2f-4cab-b361-4046f974a63f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e266486d-7987-56de-b3df-8065a18b2d4b", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.475Z", "created_at": "2026-09-26T19:13:25.252Z", "modified": "2026-09-26T19:13:25.577Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:25.577Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "9f5cd832-3be9-4226-bd07-e10e95f5aa29", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e286cdd0-bd2a-5218-bdf5-f56e77760469", "toId": "c074b72c-bc97-4a80-8672-4638da69a768", "to_id": "c074b72c-bc97-4a80-8672-4638da69a768", "to_name": "Bulgaria", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.471Z", "created_at": "2026-09-26T19:13:40.186Z", "modified": "2026-09-26T19:13:40.701Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:40.701Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "9ff5fe6b-9f38-491f-a23d-d5b7c9a03aff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2feeb926-266a-5841-91ba-c2fe2fd513d0", "toId": "489efa86-e1fa-4076-be39-0e9fa106df1c", "to_id": "489efa86-e1fa-4076-be39-0e9fa106df1c", "to_name": "Austria", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.022Z", "created_at": "2026-01-18T14:38:27.019Z", "modified": "2026-01-18T14:38:27.266Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:27.266Z" }, "description_available": true, "entity_type": "located-at", "fromId": "39f69425-0763-4b1f-abff-f0a67ab24fb5", "from_id": "39f69425-0763-4b1f-abff-f0a67ab24fb5", "from_name": "Costa Rica", "from_type": "Country", "id": "a54f607f-4d57-4a09-bb07-b61ca1a0a056", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--33a0c4a5-2635-5df0-b4da-676ab6dcf7b0", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.524Z", "created_at": "2026-09-26T19:14:37.131Z", "modified": "2026-09-26T19:14:37.430Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:37.430Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "a5c68671-8776-48a6-a665-a8520693da56", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2344eaf7-0004-569a-adef-3dc59d026757", "toId": "da958c05-87dd-4106-b048-60d2894f54bb", "to_id": "da958c05-87dd-4106-b048-60d2894f54bb", "to_name": "CVE-2026-79756", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.482Z", "created_at": "2026-09-26T19:13:44.225Z", "modified": "2026-09-26T19:13:44.828Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:44.828Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "a60dad53-f794-420d-aded-2a4b6a936c62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--c64e3155-2a35-5c5a-8317-a8b47b517f68", "toId": "44e9dff0-dc9c-4409-82c2-284087fdf928", "to_id": "44e9dff0-dc9c-4409-82c2-284087fdf928", "to_name": "Greece", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.492Z", "created_at": "2026-09-26T19:14:00.820Z", "modified": "2026-09-26T19:14:01.084Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:01.084Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "a68b4841-67fd-45ec-8b7d-46690d290ee6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9d8eabad-0784-5c2f-bdd1-edbd2f63b382", "toId": "39c8e739-b7f2-4a6c-bea0-facfb73d6cd9", "to_id": "39c8e739-b7f2-4a6c-bea0-facfb73d6cd9", "to_name": "Monaco", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.493Z", "created_at": "2026-09-26T19:14:03.419Z", "modified": "2026-09-26T19:14:03.975Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:03.975Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "a71f87ae-2558-4b80-a4e5-53e55683557d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--003696c6-6d9f-52bc-92e9-f6b891cdb795", "toId": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_id": "9ebd9843-38da-417d-8c94-c4c6e1ef07af", "to_name": "Netherlands", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.470Z", "created_at": "2026-09-26T19:13:19.732Z", "modified": "2026-09-26T19:13:19.923Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:19.923Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "a7fffa4e-ebd9-40ab-886c-764746cbcca1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a49142b1-5386-5757-9ca0-2d31777344c8", "toId": "880dee21-0fd5-45d3-b468-1d63fe6eff58", "to_id": "880dee21-0fd5-45d3-b468-1d63fe6eff58", "to_name": "Albania", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.485Z", "created_at": "2026-09-26T19:13:46.685Z", "modified": "2026-09-26T19:13:47.102Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:47.102Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "aa85f596-d25d-4c35-ae49-89f868de4dd7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--ca0ecd32-b061-5acb-9737-0baf0b5c0bdb", "toId": "fc7fcdaa-ff78-412e-94e8-8d3dfe41596f", "to_id": "fc7fcdaa-ff78-412e-94e8-8d3dfe41596f", "to_name": "Iran, Islamic Republic of", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:39:22.279Z", "modified": "2026-01-18T14:39:22.724Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:22.724Z" }, "description_available": true, "entity_type": "located-at", "fromId": "55aa32ee-212e-4703-b538-80e0de523755", "from_id": "55aa32ee-212e-4703-b538-80e0de523755", "from_name": "Hungary", "from_type": "Country", "id": "abb0feed-99e3-425c-90f0-7a9cfe073b9c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--7b29d65e-bca9-5fef-8cca-a9297452f397", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.495Z", "created_at": "2026-09-26T19:14:05.219Z", "modified": "2026-09-26T19:14:05.382Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:05.382Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "abb8a613-9b98-4dd0-abaa-bc11e5dfca9b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--8f93a89b-da71-5f28-9c06-372df743eec8", "toId": "0bd2f670-947a-490e-86a7-8ad5b775cb17", "to_id": "0bd2f670-947a-490e-86a7-8ad5b775cb17", "to_name": "Philippines", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.498Z", "created_at": "2026-09-26T19:14:08.894Z", "modified": "2026-09-26T19:14:09.099Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:09.099Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "b366976c-4ff4-444b-ba5c-26d17b29d377", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--34c206a0-4711-527c-93da-d4fcddedd37d", "toId": "943fd578-2671-43c0-b698-b21b30065383", "to_id": "943fd578-2671-43c0-b698-b21b30065383", "to_name": "Russian Federation", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:38:50.870Z", "modified": "2026-01-18T14:38:52.213Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:52.213Z" }, "description_available": true, "entity_type": "located-at", "fromId": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_name": "Japan", "from_type": "Country", "id": "ba1c989f-7204-4e06-b9e2-1365d405256b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--0cf338f5-2612-5a1e-adb0-c70b50991dca", "toId": "5e22af61-1616-46dc-b076-551e7f99593f", "to_id": "5e22af61-1616-46dc-b076-551e7f99593f", "to_name": "Eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.057Z", "created_at": "2026-01-18T14:39:44.240Z", "modified": "2026-01-18T14:39:44.405Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:44.405Z" }, "description_available": true, "entity_type": "located-at", "fromId": "880dee21-0fd5-45d3-b468-1d63fe6eff58", "from_id": "880dee21-0fd5-45d3-b468-1d63fe6eff58", "from_name": "Albania", "from_type": "Country", "id": "ba47cdbb-fedb-4d56-83fe-3c718790a0b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--c7fe4ed7-f1a0-5c87-927e-bf3aaf9806e5", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.487Z", "created_at": "2026-09-26T19:13:55.668Z", "modified": "2026-09-26T19:13:55.873Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:55.873Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "babad06e-a34f-4f08-b294-1c72fc724658", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--676e48ac-024b-5589-8da3-c770cea95c7b", "toId": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_name": "Japan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.494Z", "created_at": "2026-09-26T19:14:09.326Z", "modified": "2026-09-26T19:14:09.474Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:09.474Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "bbf1626c-f127-4fb6-bd6f-52ad5324d839", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--df30bb28-5140-5548-8a8a-a2ec1e4a2ff5", "toId": "3c1bc586-80e4-4c02-8766-2549979a6b66", "to_id": "3c1bc586-80e4-4c02-8766-2549979a6b66", "to_name": "Pakistan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.477Z", "created_at": "2026-09-26T19:13:28.992Z", "modified": "2026-09-26T19:13:29.232Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:29.232Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "bd92f159-66bf-4c0e-8859-71c5a6c0782f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--7b729878-90b3-5f44-9717-93da0d5780c3", "toId": "39f69425-0763-4b1f-abff-f0a67ab24fb5", "to_id": "39f69425-0763-4b1f-abff-f0a67ab24fb5", "to_name": "Costa Rica", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.056Z", "created_at": "2026-01-18T14:39:37.777Z", "modified": "2026-01-18T14:39:38.064Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:38.064Z" }, "description_available": true, "entity_type": "located-at", "fromId": "fff2d669-c6ca-468f-9b4d-3024f03b2d28", "from_id": "fff2d669-c6ca-468f-9b4d-3024f03b2d28", "from_name": "Norway", "from_type": "Country", "id": "c02db64d-611d-49af-be69-289ef6764b69", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--d74a9408-1e8c-5e6a-9cc9-a149fcb7d93f", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.504Z", "created_at": "2026-09-26T19:14:12.953Z", "modified": "2026-09-26T19:14:13.189Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:13.189Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "c15d561d-36e0-4fdc-8b91-b94b905f78a5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--ac9b5aa8-fcdc-57d8-881c-f5b47a6740f0", "toId": "f9d229c5-59ab-4f55-ba05-e4f1bc412969", "to_id": "f9d229c5-59ab-4f55-ba05-e4f1bc412969", "to_name": "Ukraine", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:40:00.031Z", "modified": "2026-01-18T14:40:00.787Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:40:00.787Z" }, "description_available": true, "entity_type": "located-at", "fromId": "402b2086-638d-4a79-88bb-c79acff485d8", "from_id": "402b2086-638d-4a79-88bb-c79acff485d8", "from_name": "Australia", "from_type": "Country", "id": "c5060747-c183-4928-8cfd-b21087a98ea5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9d7fbfbe-66b8-5b09-8851-72dc8a97d47e", "toId": "2730372a-ef6c-4210-bc27-805102dc639f", "to_id": "2730372a-ef6c-4210-bc27-805102dc639f", "to_name": "Australia and New Zealand", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.060Z", "created_at": "2026-01-18T14:39:47.582Z", "modified": "2026-01-18T14:39:47.854Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:47.854Z" }, "description_available": true, "entity_type": "located-at", "fromId": "6d717ddf-b5e6-4c07-9b16-ba739399f54a", "from_id": "6d717ddf-b5e6-4c07-9b16-ba739399f54a", "from_name": "Spain", "from_type": "Country", "id": "c51b08fa-3149-4f11-9e1a-3d175537077e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e9115e04-3c6a-5904-bd45-0b7ee8304df4", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.017Z", "created_at": "2026-01-18T14:38:13.105Z", "modified": "2026-01-18T14:38:13.359Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:13.359Z" }, "description_available": true, "entity_type": "located-at", "fromId": "fa70ab4c-4197-4a53-9dc7-00d90286f3bb", "from_id": "fa70ab4c-4197-4a53-9dc7-00d90286f3bb", "from_name": "Guadeloupe", "from_type": "Country", "id": "c675e911-a47c-4b4c-9712-de8a7703e2d5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--b19eb24a-197a-5fb4-83be-0a859f8f04c4", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.028Z", "created_at": "2026-01-18T14:38:32.675Z", "modified": "2026-01-18T14:38:32.904Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:32.904Z" }, "description_available": true, "entity_type": "located-at", "fromId": "fefdf4b3-183f-4689-88e4-bf940937522c", "from_id": "fefdf4b3-183f-4689-88e4-bf940937522c", "from_name": "Colombia", "from_type": "Country", "id": "c8706681-8b58-4308-9605-8c1c67a3b4eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--6660c979-2508-54d7-8572-7d9ad96c7e05", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.734Z", "created_at": "2026-09-26T19:19:34.056Z", "modified": "2026-09-26T19:19:34.494Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:19:34.494Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ff5353df-e61d-4ea6-914a-be71132ee863", "from_id": "ff5353df-e61d-4ea6-914a-be71132ee863", "from_name": null, "from_type": "Indicator", "id": "c9eda36b-238f-44ab-bc4e-c45281af1bd9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--08368ee6-4028-5c3a-a5a8-99a1f2d00084", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.041Z", "created_at": "2026-01-18T14:38:49.453Z", "modified": "2026-01-18T14:38:49.812Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:49.812Z" }, "description_available": true, "entity_type": "located-at", "fromId": "44f005d1-ae5e-4d44-99e6-a75203662d2d", "from_id": "44f005d1-ae5e-4d44-99e6-a75203662d2d", "from_name": "Taiwan", "from_type": "Country", "id": "ca9a15b3-b89a-4712-8544-ee6343853310", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a5201dba-8251-5ae1-b40f-f719c56d5eea", "toId": "5e22af61-1616-46dc-b076-551e7f99593f", "to_id": "5e22af61-1616-46dc-b076-551e7f99593f", "to_name": "Eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.503Z", "created_at": "2026-09-26T19:14:12.577Z", "modified": "2026-09-26T19:14:12.766Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:12.766Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "cc6ca563-1a40-48cf-9e9c-71af0cc193a5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2136b7d9-b191-56dd-bb8a-6ddb2b0b98c6", "toId": "bbba6d60-0079-4957-bb12-8e1c8f03a5c9", "to_id": "bbba6d60-0079-4957-bb12-8e1c8f03a5c9", "to_name": "Thailand", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.476Z", "created_at": "2026-09-26T19:13:27.568Z", "modified": "2026-09-26T19:13:27.708Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:27.708Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "cea6d72c-32fb-4768-adf1-9982a9e956de", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--071fa23b-76df-5c5e-bf39-c271358c6cc8", "toId": "d91d9170-3c76-4158-9559-2db658404d55", "to_id": "d91d9170-3c76-4158-9559-2db658404d55", "to_name": "China", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.062Z", "created_at": "2026-01-18T14:39:54.326Z", "modified": "2026-01-18T14:39:54.642Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:54.642Z" }, "description_available": true, "entity_type": "located-at", "fromId": "8a198689-d83f-46bd-98c3-a2f76adae719", "from_id": "8a198689-d83f-46bd-98c3-a2f76adae719", "from_name": "Switzerland", "from_type": "Country", "id": "d2d4d379-46b2-4577-ac10-b9e31eefb4e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--05d77538-ab5b-598d-a987-f460b445b959", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.001Z", "created_at": "2026-01-18T14:37:23.360Z", "modified": "2026-01-18T14:37:23.561Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:37:23.561Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "from_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "from_name": "Sub-Saharan Africa", "from_type": "Region", "id": "d5a551bf-8e48-4170-8e04-6f35bc3ddd9c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--2229f684-8d2e-5463-a181-1e9500b61b26", "toId": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "to_id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "to_name": "Africa", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.061Z", "created_at": "2026-01-18T14:39:50.718Z", "modified": "2026-01-18T14:39:51.264Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:51.264Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "from_id": "5f9b6cfa-10ff-4746-bedf-f8d906b72f2c", "from_name": "Belgium", "from_type": "Country", "id": "d6cc3c74-c275-4e36-a2f9-5e60ec862c80", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9fd0e702-c9dc-5f2f-97d6-a24fd3e0c19a", "toId": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "to_name": "Western Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.723Z", "created_at": "2026-09-26T19:19:21.932Z", "modified": "2026-09-26T19:19:22.218Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:19:22.218Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9fb0937-5fb3-45a2-9d1a-09f04c80c2a5", "from_id": "c9fb0937-5fb3-45a2-9d1a-09f04c80c2a5", "from_name": null, "from_type": "Indicator", "id": "d8ee0eb8-1e18-4a5d-8370-550d4e60212b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--8b8e2aec-744e-5107-b331-5c8919623b55", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.734Z", "created_at": "2026-09-26T07:08:39.457Z", "modified": "2026-09-26T07:08:39.768Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:39.768Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "d9f2912e-5f96-488d-bed1-401f455e0748", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--d1574184-4db7-55d4-80f5-09df9f2f6576", "toId": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_id": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_name": "CVE-2026-60004", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:38:41.111Z", "modified": "2026-01-18T14:38:41.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:41.841Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3460c7f0-1521-461b-af64-2de060664fb1", "from_id": "3460c7f0-1521-461b-af64-2de060664fb1", "from_name": "United States of America", "from_type": "Country", "id": "daee60ed-495b-4626-8967-6a667c789917", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--98d1ce2f-0759-5c90-a6e9-100a3a2299a7", "toId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_name": "Northern America", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:38:48.156Z", "modified": "2026-01-18T14:38:48.535Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:48.535Z" }, "description_available": true, "entity_type": "located-at", "fromId": "4b29d74f-fe60-4f8a-a211-324ea1a572fa", "from_id": "4b29d74f-fe60-4f8a-a211-324ea1a572fa", "from_name": "Mongolia", "from_type": "Country", "id": "dcd07ac0-5ec6-4742-b8c0-684beba12a81", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--3fab2912-fb62-5e8d-9796-ae8e724184a9", "toId": "5e22af61-1616-46dc-b076-551e7f99593f", "to_id": "5e22af61-1616-46dc-b076-551e7f99593f", "to_name": "Eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.059Z", "created_at": "2026-01-18T14:39:45.298Z", "modified": "2026-01-18T14:39:45.598Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:45.598Z" }, "description_available": true, "entity_type": "located-at", "fromId": "07cbe900-6e4d-4c1e-8ac0-85a6000ba707", "from_id": "07cbe900-6e4d-4c1e-8ac0-85a6000ba707", "from_name": "Malta", "from_type": "Country", "id": "dd0bd476-de32-4892-929b-fd2496378138", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--92e36b7d-f638-5099-9872-adcf62592803", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.520Z", "created_at": "2026-09-26T19:14:35.865Z", "modified": "2026-09-26T19:14:36.069Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:36.069Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "dddda0cf-1ae2-4141-b4a3-e1775b73a087", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--f60a90d2-3b4b-5a76-9fa1-4054ed94f8f7", "toId": "cfdc76a1-dbf8-4cfb-88d0-b6a2742b4745", "to_id": "cfdc76a1-dbf8-4cfb-88d0-b6a2742b4745", "to_name": "CVE-2026-7273", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.050Z", "created_at": "2026-01-18T14:39:21.299Z", "modified": "2026-01-18T14:39:21.834Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:21.834Z" }, "description_available": true, "entity_type": "located-at", "fromId": "c074b72c-bc97-4a80-8672-4638da69a768", "from_id": "c074b72c-bc97-4a80-8672-4638da69a768", "from_name": "Bulgaria", "from_type": "Country", "id": "de879c26-d36a-4b95-b345-92fc3427a76c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--16b68393-4868-5e7a-95f1-7522fcdbbcda", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.505Z", "created_at": "2026-09-26T19:14:13.416Z", "modified": "2026-09-26T19:14:13.591Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:13.591Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "de98cd22-167d-4da3-864e-002ffafbe80d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--d7104215-5ea4-55b2-b9c9-2cf8cef70eaf", "toId": "c8d88472-f56e-445a-be11-f5c5b2794ac4", "to_id": "c8d88472-f56e-445a-be11-f5c5b2794ac4", "to_name": "United Arab Emirates", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.676Z", "created_at": "2026-09-26T19:18:27.906Z", "modified": "2026-09-26T19:18:28.496Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:28.496Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ff5353df-e61d-4ea6-914a-be71132ee863", "from_id": "ff5353df-e61d-4ea6-914a-be71132ee863", "from_name": null, "from_type": "Indicator", "id": "df1835d5-af38-42df-b60e-5942472eacd3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--eaafcd21-7a1f-502c-8ac9-5fde9bd81de6", "toId": "0f1b3995-e279-456f-b374-0b28db1f6749", "to_id": "0f1b3995-e279-456f-b374-0b28db1f6749", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.480Z", "created_at": "2026-09-26T19:13:38.114Z", "modified": "2026-09-26T19:13:38.366Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:38.366Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "df38c316-d355-40e9-969d-e3b2e0bfa22a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--ae7b068a-4b72-51de-ac3e-c70ebbaec13c", "toId": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_id": "28acec63-0804-49d2-95fa-8beb12f12b33", "to_name": "France", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-06-05T20:32:29.353Z", "created_at": "2026-06-05T21:18:56.225Z", "modified": "2026-09-26T19:18:26.958Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:18:26.958Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7def13ab-2ef4-4447-be92-6ca0d91c791c", "from_id": "7def13ab-2ef4-4447-be92-6ca0d91c791c", "from_name": null, "from_type": "Indicator", "id": "e073b82e-2347-473f-a86c-298baa379f8f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--881b0f26-b926-5fb7-beda-6c2789aed08d", "toId": "7d11c550-f9b5-413a-b87d-822e1a3904dd", "to_id": "7d11c550-f9b5-413a-b87d-822e1a3904dd", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.045Z", "created_at": "2026-01-18T14:39:02.211Z", "modified": "2026-01-18T14:39:02.978Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:02.978Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3c1bc586-80e4-4c02-8766-2549979a6b66", "from_id": "3c1bc586-80e4-4c02-8766-2549979a6b66", "from_name": "Pakistan", "from_type": "Country", "id": "e4c5a088-6266-47d2-89ec-7a3d4ca9661f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--c292bccb-a3e5-5d83-8486-7540610cbd87", "toId": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "to_name": "Southern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.521Z", "created_at": "2026-09-26T19:14:34.053Z", "modified": "2026-09-26T19:14:34.227Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:34.227Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "e6804ba3-2b63-4e32-91e0-54b5ce37cc75", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--9bfa7956-82dc-5187-90fd-d67ec7580bf0", "toId": "802136a0-c009-4e53-a497-45699929f503", "to_id": "802136a0-c009-4e53-a497-45699929f503", "to_name": "CVE-2026-60137", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.484Z", "created_at": "2026-09-26T19:13:45.123Z", "modified": "2026-09-26T19:13:45.528Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:45.528Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "e71880f5-ae12-411b-beac-c0442caece90", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e6fc1d79-49db-53b1-9e8f-0d15a0793885", "toId": "a5f4f35e-0f44-4b6f-858b-931d9a747f20", "to_id": "a5f4f35e-0f44-4b6f-858b-931d9a747f20", "to_name": "Iceland", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.058Z", "created_at": "2026-01-18T14:39:41.421Z", "modified": "2026-01-18T14:39:41.629Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:41.629Z" }, "description_available": true, "entity_type": "located-at", "fromId": "44e9dff0-dc9c-4409-82c2-284087fdf928", "from_id": "44e9dff0-dc9c-4409-82c2-284087fdf928", "from_name": "Greece", "from_type": "Country", "id": "e7512c38-52fc-4f72-9d8c-b5da4442b857", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--79a8661b-0434-55f6-9b91-f0ab1c14823a", "toId": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "to_name": "Southern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.474Z", "created_at": "2026-09-26T19:13:23.724Z", "modified": "2026-09-26T19:13:24.250Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:24.250Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "eb6d2ebd-358f-47af-b757-76c53c511bb7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--de0c3d1a-2bfd-5c17-a44b-f6061e0b1668", "toId": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_id": "f571f0ef-816b-43b9-98be-7dd1ec907646", "to_name": "British Indian Ocean Territory", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.042Z", "created_at": "2026-01-18T14:38:53.493Z", "modified": "2026-01-18T14:38:53.750Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:53.750Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0425dea7-3eb6-4bae-b195-9e5cdac1c15d", "from_id": "0425dea7-3eb6-4bae-b195-9e5cdac1c15d", "from_name": "Malaysia", "from_type": "Country", "id": "eb6f0a40-21a1-4469-9448-3a36e7cb31db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--1bb8b21d-e94b-582f-8de2-3070b0d7ea31", "toId": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "to_name": "South-eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.055Z", "created_at": "2026-01-18T14:39:39.087Z", "modified": "2026-01-18T14:39:39.339Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:39.339Z" }, "description_available": true, "entity_type": "located-at", "fromId": "90fc2c57-deea-4c83-9d78-2445ddbc26c7", "from_id": "90fc2c57-deea-4c83-9d78-2445ddbc26c7", "from_name": "Finland", "from_type": "Country", "id": "ec88058b-ef01-4ce4-a564-b5568b88a909", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--f94705e7-c9a3-555c-b029-8aa003636d41", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.497Z", "created_at": "2026-09-26T19:14:07.783Z", "modified": "2026-09-26T19:14:07.991Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:07.991Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "f0587dc4-2de8-45ca-b2c8-231af9737697", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--b5db4628-b622-5d8d-8ccc-0f5318032e8c", "toId": "9c55f3b9-481d-4628-83d3-a6fa22f1b0e3", "to_id": "9c55f3b9-481d-4628-83d3-a6fa22f1b0e3", "to_name": "Portugal", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.520Z", "created_at": "2026-09-26T19:14:30.277Z", "modified": "2026-09-26T19:14:32.090Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:32.090Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "f0a91537-12b7-40d9-9272-eac4f6608318", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--159cb2dc-03b1-567f-864c-dcfa04c563de", "toId": "57532ce3-ad83-46ae-82eb-674ed56967fb", "to_id": "57532ce3-ad83-46ae-82eb-674ed56967fb", "to_name": "CVE-2026-34910", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.051Z", "created_at": "2026-01-18T14:39:24.803Z", "modified": "2026-01-18T14:39:25.133Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:25.133Z" }, "description_available": true, "entity_type": "located-at", "fromId": "943fd578-2671-43c0-b698-b21b30065383", "from_id": "943fd578-2671-43c0-b698-b21b30065383", "from_name": "Russian Federation", "from_type": "Country", "id": "f81315b1-b95e-4a6e-9819-88e18e97c458", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--ba1e9e71-42ee-5638-a83f-15949de67a6a", "toId": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "to_name": "Eastern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.500Z", "created_at": "2026-09-26T19:14:10.272Z", "modified": "2026-09-26T19:14:10.457Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:10.457Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "f95b1956-898d-4e14-a38c-4929660ada29", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--e1745e7a-5044-517d-910a-fddd8e64519f", "toId": "204e3ce5-7698-48bd-a847-07922b85ff44", "to_id": "204e3ce5-7698-48bd-a847-07922b85ff44", "to_name": "South Africa", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.523Z", "created_at": "2026-09-26T19:14:36.450Z", "modified": "2026-09-26T19:14:36.637Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:14:36.637Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "fa266990-dd9a-4329-ad8f-bbfa61967f48", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--16792ca4-3993-5f0b-a760-8cbdf009a7ac", "toId": "761ea0f1-54fc-4a33-ae87-2c3f18b3b3db", "to_id": "761ea0f1-54fc-4a33-ae87-2c3f18b3b3db", "to_name": "CVE-2026-54569", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.477Z", "created_at": "2026-09-26T19:13:28.341Z", "modified": "2026-09-26T19:13:28.634Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:28.634Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "faa610eb-ffef-48c6-a9ca-eff197a3be34", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--7af5e499-48d3-5783-a545-9eb550aa8687", "toId": "fefdf4b3-183f-4689-88e4-bf940937522c", "to_id": "fefdf4b3-183f-4689-88e4-bf940937522c", "to_name": "Colombia", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.056Z", "created_at": "2026-01-18T14:39:34.806Z", "modified": "2026-01-18T14:39:35.090Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:35.090Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f3521355-05dc-4951-b97e-0fa007cf66f3", "from_id": "f3521355-05dc-4951-b97e-0fa007cf66f3", "from_name": "Latvia", "from_type": "Country", "id": "fbaaa26d-203d-4203-baa3-63f59837382a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--0af9205c-141f-5cb1-a2e4-14f85b87aad1", "toId": "d5563518-7ebb-46ed-a037-525564906cd9", "to_id": "d5563518-7ebb-46ed-a037-525564906cd9", "to_name": "Northern Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.043Z", "created_at": "2026-01-18T14:38:57.608Z", "modified": "2026-01-18T14:38:58.126Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:58.126Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0edd7cee-c750-4a70-82dc-a493fef311a8", "from_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "from_name": "Southern Asia", "from_type": "Region", "id": "fc94576d-aa18-45ec-b2d5-c5fc89a3a2ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--a6d11fc4-a24e-5137-a9f8-f178f9ed60de", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.052Z", "created_at": "2026-01-18T14:39:26.819Z", "modified": "2026-01-18T14:39:27.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:39:27.423Z" }, "description_available": true, "entity_type": "located-at", "fromId": "d5563518-7ebb-46ed-a037-525564906cd9", "from_id": "d5563518-7ebb-46ed-a037-525564906cd9", "from_name": "Northern Europe", "from_type": "Region", "id": "fdcf6f17-867b-42f3-aecc-004afc94a3a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--44bf8f8f-17e0-5590-93ed-b598e74291a6", "toId": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "to_name": "Europe", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.469Z", "created_at": "2026-09-26T19:13:15.360Z", "modified": "2026-09-26T19:13:15.638Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:15.638Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "fed07539-b82d-4fa8-b716-a7280fe80e11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--b76ac697-f831-5942-b29f-296aabf4f080", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:59:03.479Z", "created_at": "2026-09-26T19:13:36.764Z", "modified": "2026-09-26T19:13:37.017Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T19:13:37.017Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "ff6cbc7e-c1ce-444a-9348-059f49a2a4b5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "standard_id": "relationship--f7120064-5e8d-5303-ad5b-3bb389e7197f", "toId": "59722221-e14e-4a05-ab01-f9f7c9fc83ab", "to_id": "59722221-e14e-4a05-ab01-f9f7c9fc83ab", "to_name": "Estonia", "to_type": "Country" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "104[.]225[.]153[.]141", "description_available": true, "object_id": "7def13ab-2ef4-4447-be92-6ca0d91c791c", "object_ids": [ "7d11c550-f9b5-413a-b87d-822e1a3904dd", "7def13ab-2ef4-4447-be92-6ca0d91c791c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7def13ab-2ef4-4447-be92-6ca0d91c791c", "valid_from": "2026-09-23T12:40:40.000Z", "valid_until": "2026-10-13T18:15:19.434Z", "validity_status": "active", "value": "104.225.153.141" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "7d11c550-f9b5-413a-b87d-822e1a3904dd", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "104.225.153.141" } ], "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "type": "ipv4", "valid_from": "2026-09-23T12:40:40.000Z", "valid_until": "2026-10-13T18:15:19.434Z", "validity_status": "active", "value": "104.225.153.141" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "defanged": "172[.]245[.]247[.]21", "description_available": false, "object_id": "0f1b3995-e279-456f-b374-0b28db1f6749", "object_ids": [ "0f1b3995-e279-456f-b374-0b28db1f6749" ], "source_objects": [ { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "0f1b3995-e279-456f-b374-0b28db1f6749", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "172.245.247.21" } ], "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "type": "ipv4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "172.245.247.21" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "defanged": "74[.]48[.]66[.]73", "description_available": false, "object_id": "e3a7a02f-4e1f-4821-8dba-91ac842e9015", "object_ids": [ "e3a7a02f-4e1f-4821-8dba-91ac842e9015" ], "source_objects": [ { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "e3a7a02f-4e1f-4821-8dba-91ac842e9015", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "74.48.66.73" } ], "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "type": "ipv4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "74.48.66.73" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f", "description_available": false, "object_id": "5a1c6344-c106-4956-bee5-835d59bbd9a1", "object_ids": [ "5a1c6344-c106-4956-bee5-835d59bbd9a1", "8080812d-ede9-4e6e-91f1-bdaabe508538" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5a1c6344-c106-4956-bee5-835d59bbd9a1", "valid_from": "2026-09-22T11:40:07.000Z", "valid_until": "2027-07-09T22:49:51.557Z", "validity_status": "active", "value": "0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8080812d-ede9-4e6e-91f1-bdaabe508538", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f" } ], "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "type": "sha256", "valid_from": "2026-09-22T11:40:07.000Z", "valid_until": "2027-07-09T22:49:51.557Z", "validity_status": "active", "value": "0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6", "description_available": false, "object_id": "d4931a81-8938-4270-ace5-1bad46c5a80c", "object_ids": [ "d4931a81-8938-4270-ace5-1bad46c5a80c", "e93697ef-3aa1-41ea-92f9-eccd0b471766" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d4931a81-8938-4270-ace5-1bad46c5a80c", "valid_from": "2026-09-22T11:40:07.000Z", "valid_until": "2027-07-09T22:49:51.557Z", "validity_status": "active", "value": "0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e93697ef-3aa1-41ea-92f9-eccd0b471766", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6" } ], "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "type": "sha256", "valid_from": "2026-09-22T11:40:07.000Z", "valid_until": "2027-07-09T22:49:51.557Z", "validity_status": "active", "value": "0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1", "description_available": false, "object_id": "e065a43d-e6c0-4fd7-846c-3fe32811b1cc", "object_ids": [ "a490b7df-8b5f-4fb6-8b69-d009e8627d93", "e065a43d-e6c0-4fd7-846c-3fe32811b1cc" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e065a43d-e6c0-4fd7-846c-3fe32811b1cc", "valid_from": "2026-09-22T11:40:07.000Z", "valid_until": "2027-07-09T22:49:51.557Z", "validity_status": "active", "value": "2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "a490b7df-8b5f-4fb6-8b69-d009e8627d93", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1" } ], "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "type": "sha256", "valid_from": "2026-09-22T11:40:07.000Z", "valid_until": "2027-07-09T22:49:51.557Z", "validity_status": "active", "value": "2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1" } ], "mentioned": [ { "confidence": 100, "evidence_id": "b3cffd93-96e8-4612-9ed8-1236cbd3025c", "name": "Africa", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "name": "Americas", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "name": "Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "2730372a-ef6c-4210-bc27-805102dc639f", "name": "Australia and New Zealand", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "765d7d4d-7684-440b-bbcd-4037047b7699", "name": "Central Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "5e22af61-1616-46dc-b076-551e7f99593f", "name": "Eastern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "5d6bd716-5664-4e8f-aa2e-236ce4b87f18", "name": "Eastern Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "6e23d1d1-9fea-43f8-a01c-f1b416f6e558", "name": "Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "name": "Latin America and the Caribbean", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "83ee16e7-a32f-4c97-ab6a-627957b0b061", "name": "Middle East", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "name": "Northern America", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "d5563518-7ebb-46ed-a037-525564906cd9", "name": "Northern Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "6c3ce996-c654-4b25-8b6d-f983459d54a6", "name": "Oceania", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "c0c50eda-edd8-4175-a851-a0bb39fc00cb", "name": "South-eastern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0edd7cee-c750-4a70-82dc-a493fef311a8", "name": "Southern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "a0e1e265-1d26-40b4-9012-64fcb4feac59", "name": "Southern Europe", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "2ddebcb7-f192-4ba6-9d42-5f830cffc4c8", "name": "Sub-Saharan Africa", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "19856f95-c02b-4df4-95b6-96e8c1d9896a", "name": "Western Europe", "role": "mentionné", "type": "Region" }, { "confidence": 80, "evidence_id": "32a5d6cf-94de-41cb-93a4-f1535d89cf14", "name": "CVE-2022-0847", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "453ee776-b61e-4171-8009-fc5407da6913", "name": "CVE-2023-54391", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "6bf00d62-0c1f-4ab6-a2b6-a0ea715efb88", "name": "CVE-2026-34908", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "248a7566-ed41-4b3d-9727-3c7b60880f1b", "name": "CVE-2026-34909", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "57532ce3-ad83-46ae-82eb-674ed56967fb", "name": "CVE-2026-34910", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "761ea0f1-54fc-4a33-ae87-2c3f18b3b3db", "name": "CVE-2026-54569", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "c26b89cd-81e5-4d81-b9e5-59dc7ebb0e7a", "name": "CVE-2026-56271", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "31b901d5-1e5f-4752-9173-f0144572ec05", "name": "CVE-2026-60004", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "802136a0-c009-4e53-a497-45699929f503", "name": "CVE-2026-60137", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "4f275781-30af-4e1e-affa-090a4b6c7f16", "name": "CVE-2026-63030", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "cfdc76a1-dbf8-4cfb-88d0-b6a2742b4745", "name": "CVE-2026-7273", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "da958c05-87dd-4106-b048-60d2894f54bb", "name": "CVE-2026-79756", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-22T11:40:06.751Z", "created_at": "2026-09-26T19:20:08.808Z", "modified": "2026-09-26T19:28:24.260Z", "published": "2026-09-22T11:40:06.751Z", "updated_at": "2026-09-26T19:28:24.260Z" }, "description_available": true, "id": "341fb034-ffc5-49ce-8842-5b21bb4c0d11", "is_inferred": false, "labels": [ "chinese-speaking actor", "cve-2022-0847", "cve-2023-54391", "cve-2026-34908", "cve-2026-34909", "cve-2026-34910", "cve-2026-54569", "cve-2026-56271", "cve-2026-60004", "cve-2026-60137", "cve-2026-63030", "cve-2026-7273", "cve-2026-79756", "data exfiltration", "government breach", "kapibala", "privilege escalation", "wordpress exploitation", "zyxel switches" ], "lang": "en", "name": "Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-22T11:40:06.751Z", "references": [ { "external_id": null, "id": "5d10d6a4-bf46-479a-830e-c9cd3bfc3d08", "source_name": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation" }, { "external_id": "6ab2691621023818faaf620e", "id": "9fcc6324-ce2f-4068-8e92-8bdcf70d51d4", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ab2691621023818faaf620e" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation" }, "targets": [ { "confidence": 50, "evidence_id": "a7fffa4e-ebd9-40ab-886c-764746cbcca1", "name": "Albania", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "0a54da30-8912-43e6-a269-26af72fb4035", "name": "Australia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "9ff5fe6b-9f38-491f-a23d-d5b7c9a03aff", "name": "Austria", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "18bc6443-688f-44bd-a57e-63745864f58d", "name": "Belarus", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "673c2877-92d4-4372-8bf6-6a566989047d", "name": "Belgium", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "80283e88-1dd7-46a7-bab5-4caed1c68852", "name": "Brazil", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "eb6d2ebd-358f-47af-b757-76c53c511bb7", "name": "British Indian Ocean Territory", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "9f5cd832-3be9-4226-bd07-e10e95f5aa29", "name": "Bulgaria", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "4600a57c-1705-4691-864c-42c246250820", "name": "Chile", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "cea6d72c-32fb-4768-adf1-9982a9e956de", "name": "China", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "faa610eb-ffef-48c6-a9ca-eff197a3be34", "name": "Colombia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "bd92f159-66bf-4c0e-8859-71c5a6c0782f", "name": "Costa Rica", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "1a4b3750-c569-497d-b050-b3f6785ddff1", "name": "Czechia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "358458b4-130f-4a65-afed-080c32cd0b76", "name": "Denmark", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "ff6cbc7e-c1ce-444a-9348-059f49a2a4b5", "name": "Estonia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "09dc5ee3-6a14-411c-91c9-f4a518f4b99e", "name": "Finland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "df38c316-d355-40e9-969d-e3b2e0bfa22a", "name": "France", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "7ac16cd0-4b2f-4c7e-b4d7-f3e9743e6782", "name": "Germany", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "9dd0ebe2-2b2f-4cab-b361-4046f974a63f", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "a60dad53-f794-420d-aded-2a4b6a936c62", "name": "Greece", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "4df2d45d-b925-4c51-90ca-7173273859f2", "name": "Guadeloupe", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "2e0fc0ae-e047-46f2-8fcc-4c7acb7e6b4d", "name": "Hong Kong", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "6cb7ced8-da58-4f66-82e7-12d18d2c23dc", "name": "Hungary", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "e71880f5-ae12-411b-beac-c0442caece90", "name": "Iceland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "5736a512-3d0f-4e95-94a8-d8524cfc24e1", "name": "India", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "aa85f596-d25d-4c35-ae49-89f868de4dd7", "name": "Iran, Islamic Republic of", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "17b714d5-2212-4b76-a5e5-b8a51a859d73", "name": "Ireland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "1b03426b-92f9-460b-924c-2915e414986a", "name": "Italy", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "babad06e-a34f-4f08-b294-1c72fc724658", "name": "Japan", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "7e467f93-dfb9-4321-97bc-8aa9ab7e9aa1", "name": "Latvia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "7083dbaa-9b6a-4a03-a5b9-77148533163e", "name": "Lithuania", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "0edea8e5-2342-4b7e-8893-a04e18f1e8f2", "name": "Madagascar", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "0dc71c00-b55a-41cb-9300-6b776fe3fb92", "name": "Malaysia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "4f12bcd7-2e5e-42f7-a8db-f6959e0c7275", "name": "Malta", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "6b9cf8a9-e428-4e52-b075-f61f38f46afc", "name": "Martinique", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "a68b4841-67fd-45ec-8b7d-46690d290ee6", "name": "Monaco", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "7edcd174-b2ba-4093-9fb6-47d2e980f3d8", "name": "Mongolia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "a71f87ae-2558-4b80-a4e5-53e55683557d", "name": "Netherlands", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "1d339e91-7f7d-4fb5-91d6-01eb3e2b7c9b", "name": "Norway", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "bbf1626c-f127-4fb6-bd6f-52ad5324d839", "name": "Pakistan", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "3efff502-d5d9-46a2-b01e-a001820cd1ad", "name": "Panama", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "abb8a613-9b98-4dd0-abaa-bc11e5dfca9b", "name": "Philippines", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "9ad97a07-f551-49c6-b931-66b0d336a552", "name": "Poland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "f0587dc4-2de8-45ca-b2c8-231af9737697", "name": "Portugal", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "56908e73-8440-4fff-872e-7adecbfd1f71", "name": "Romania", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "b366976c-4ff4-444b-ba5c-26d17b29d377", "name": "Russian Federation", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "04663ba5-183f-4777-ae76-d68ffd717680", "name": "Slovakia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "1480b93c-71b9-4b56-b8dd-ed2c662044f3", "name": "Slovenia", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "f95b1956-898d-4e14-a38c-4929660ada29", "name": "South Africa", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "4b6311ee-16d0-4ea0-bc14-16193a86e84a", "name": "Spain", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "25193364-c5c8-40a0-8808-1fe094986557", "name": "Sweden", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "8431ed09-f275-4c09-a1cc-dd22223e3478", "name": "Switzerland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "7661456b-2dcd-4c04-beff-30e169ff2866", "name": "Taiwan", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "5d5edf46-580f-4ddc-9714-d47dd3d11a32", "name": "Technologies", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "cc6ca563-1a40-48cf-9e9c-71af0cc193a5", "name": "Thailand", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "c15d561d-36e0-4fdc-8b91-b94b905f78a5", "name": "Ukraine", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "de98cd22-167d-4da3-864e-002ffafbe80d", "name": "United Arab Emirates", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "63df2d24-1df9-4915-a389-251f5578f1ce", "name": "United Kingdom of Great Britain and Northern Ireland", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "fed07539-b82d-4fa8-b716-a7280fe80e11", "name": "United States of America", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "8b64307d-97a6-40f3-a8c7-7d6db0399e95", "name": "Uzbekistan", "role": "cible déclarée (relation targets)", "type": "Country" } ], "techniques": [], "vulnerabilities": [ "CVE-2022-0847", "CVE-2023-54391", "CVE-2026-34908", "CVE-2026-34909", "CVE-2026-34910", "CVE-2026-54569", "CVE-2026-56271", "CVE-2026-60004", "CVE-2026-60137", "CVE-2026-63030", "CVE-2026-7273", "CVE-2026-79756" ] }, "report_id": "341fb034-ffc5-49ce-8842-5b21bb4c0d11", "schema_version": 1, "selected_date": "2026-09-22", "source_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation" }