{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "c257b48a-4e0e-4fa0-98ff-0ecaade409e4", "name": "Longlegs", "role": "acteur lié (relation uses)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 2, "deduplicated_iocs": 21, "direct_entities": 54, "direct_relationships": 110, "invalid_iocs": 0, "iocs": 21, "mentioned": 7, "mitre_associated": 2, "mitre_direct": 1, "targets": 4, "techniques": 1, "unsupported_indicators": 0, "vulnerabilities": 5 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 80, "excluded_graph_objects": 522, "graph_complete": true, "graph_objects": 54, "graph_relationships": 110, "mitre_context_complete": true, "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "status_as_of": "2026-10-08T07:51:58+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:32.512Z", "updated_at": "2026-10-03T03:31:33.195Z" }, "description_available": false, "entity_type": "StixFile", "id": "0609e09b-3a11-42eb-868a-4a58c1088d9c", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--29e264e5-5481-5fd9-8b3e-e8191b40355c", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Communications", "Telecom", "Telecommunication", "Telecoms" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:13.791Z", "modified": "2026-03-01T15:18:16.401Z", "updated_at": "2026-03-01T15:18:16.401Z" }, "description_available": true, "entity_type": "Sector", "id": "08257c10-e1ae-4471-bc3f-251792c1126c", "is_inferred": false, "labels": [], "lang": "en", "name": "Telecommunications", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "identity--4b68fb1a-ff8b-5bef-8d2a-0e477b3ad78e", "type": "Sector" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:46.863Z", "updated_at": "2026-10-03T03:31:47.430Z" }, "description_available": false, "entity_type": "StixFile", "id": "09216b18-95cf-459b-a0cb-3e230f14d370", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--ed1a4fe6-dd6d-5da9-91b8-80b68880a113", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:41.036Z", "updated_at": "2026-10-03T03:31:43.788Z" }, "description_available": false, "entity_type": "StixFile", "id": "11e839e3-249d-4f53-a46e-58c8ac1911b2", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--e3749463-bd12-5d46-a57e-7f75c9e7eeda", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.966Z", "created_at": "2026-10-03T03:32:26.577Z", "modified": "2026-10-03T08:16:41.568Z", "updated_at": "2026-10-03T08:16:41.568Z" }, "description_available": false, "entity_type": "Indicator", "id": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--5215dcba-df0b-57fe-a254-ec95d3da1bdb", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-04-21T21:29:22.084Z", "updated_at": "2026-10-03T03:31:29.949Z" }, "description_available": false, "entity_type": "StixFile", "id": "19eaba70-a8ba-4ff6-8f34-7ba4b521a1e9", "is_inferred": false, "labels": [ "black basta", "byovd", "cardinal", "cloudflare", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "cve-2025-68947", "defense evasion", "gotohttp", "lateral movement", "lockbit", "longlegs", "nseckrnl", "ransomware", "sharepoint", "sharepoint exploitation", "storm-2603", "telecommunications", "tightvnc", "toolshell", "tunneling", "velociraptor", "vulnerable driver", "warlock", "water utility", "yuze" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--d05c3138-5193-5500-803c-e0092fc80b50", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.905Z", "created_at": "2026-10-03T03:32:00.886Z", "modified": "2026-10-03T08:15:56.233Z", "updated_at": "2026-10-03T08:15:56.233Z" }, "description_available": false, "entity_type": "Indicator", "id": "1a7a9789-0adc-4b87-b716-133383803962", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--a5e2a3bf-f506-5a09-8b43-1db63706cb9b", "type": "Indicator" }, { "__typename": "Malware", "aliases": [ "win.warlock" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T19:56:36.024Z", "created_at": "2026-01-19T02:36:43.996Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:25:52.343Z", "updated_at": "2026-10-07T03:25:52.343Z" }, "description_available": true, "entity_type": "Malware", "id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "is_inferred": false, "labels": [ "payload", "ransomware", "warlock" ], "lang": "en", "name": "WarLock", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "669730bc-f16f-48a3-bf0d-453cbcfd9c24", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.warlock" }, { "external_id": null, "id": "a29cd3f5-94e7-413e-a58c-bbe83e73a642", "source_name": "malpedia", "url": "https://t0asts.com/2025/08/16/warlock-ransomware.html" }, { "external_id": null, "id": "27f2577c-9d2f-48c5-bcee-d03b679ba010", "source_name": "malpedia", "url": "https://www.bleepingcomputer.com/news/security/colt-telecom-attack-claimed-by-warlock-ransomware-data-up-for-sale/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "malware--db413f51-4d56-5582-80e4-8537cc2d704f", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.959Z", "created_at": "2026-10-03T03:32:24.485Z", "modified": "2026-10-03T08:16:30.331Z", "updated_at": "2026-10-03T08:16:30.331Z" }, "description_available": false, "entity_type": "Indicator", "id": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--368267ec-4e0b-5999-9cfc-1a607e0bd6c1", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.956Z", "created_at": "2026-10-03T03:32:20.279Z", "modified": "2026-10-03T08:16:25.879Z", "updated_at": "2026-10-03T08:16:25.879Z" }, "description_available": false, "entity_type": "Indicator", "id": "3238884b-5f6b-4645-b6f2-e233656674e5", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--315c756a-815d-554f-87a7-2b90b97e0c52", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:38.266Z", "updated_at": "2026-10-03T03:31:38.690Z" }, "description_available": false, "entity_type": "StixFile", "id": "378c1f0d-6075-4444-9105-c34dbb7f0ad0", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--c951340b-19c2-53dd-83ce-dcb4343e1837", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:32.525Z", "updated_at": "2026-10-03T03:31:33.200Z" }, "description_available": false, "entity_type": "StixFile", "id": "37fc5e02-0c8b-49f8-a220-ad5ed23f4edb", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--4dee6867-ed54-5538-8f91-f38b8c230446", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.907Z", "created_at": "2026-10-03T03:32:00.886Z", "modified": "2026-10-03T08:15:58.177Z", "updated_at": "2026-10-03T08:15:58.177Z" }, "description_available": false, "entity_type": "Indicator", "id": "42725fae-afa8-41bf-a870-ec24ff40e37b", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--91f57960-7915-5afb-a595-8560f701202d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:32:06.069Z", "created_at": "2026-04-21T21:29:31.613Z", "modified": "2026-10-03T03:31:56.185Z", "updated_at": "2026-10-03T03:31:56.185Z" }, "description_available": false, "entity_type": "Indicator", "id": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "is_inferred": false, "labels": [ "black basta", "byovd", "cardinal", "cloudflare", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "cve-2025-68947", "defense evasion", "gotohttp", "lateral movement", "lockbit", "longlegs", "nseckrnl", "ransomware", "sharepoint", "sharepoint exploitation", "storm-2603", "telecommunications", "tightvnc", "toolshell", "tunneling", "velociraptor", "vulnerable driver", "warlock", "water utility", "yuze" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--df9e3d9a-1581-5c6c-af63-aaeaaa1ae91e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.930Z", "created_at": "2026-10-03T03:32:10.856Z", "modified": "2026-10-03T08:16:07.776Z", "updated_at": "2026-10-03T08:16:07.776Z" }, "description_available": false, "entity_type": "Indicator", "id": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--51a52d97-3945-56bb-801e-df31b806e6b4", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.915Z", "created_at": "2026-10-03T03:32:04.137Z", "modified": "2026-10-03T08:16:01.385Z", "updated_at": "2026-10-03T08:16:01.385Z" }, "description_available": false, "entity_type": "Indicator", "id": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--0e739578-5b49-5d54-91e2-38a1c94ff968", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.910Z", "created_at": "2026-10-03T03:32:00.880Z", "modified": "2026-10-03T08:15:57.926Z", "updated_at": "2026-10-03T08:15:57.926Z" }, "description_available": false, "entity_type": "Indicator", "id": "537f0804-d40f-48d7-b59e-d3342d245cb5", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--61a26047-b563-5ac2-9755-cb6fe9cebdeb", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:32:06.086Z", "created_at": "2026-04-21T21:29:34.144Z", "modified": "2026-10-03T03:31:56.186Z", "updated_at": "2026-10-03T03:31:56.186Z" }, "description_available": false, "entity_type": "Indicator", "id": "65a45293-2c6f-43fd-9605-4e90dff074be", "is_inferred": false, "labels": [ "black basta", "byovd", "cardinal", "cloudflare", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "cve-2025-68947", "defense evasion", "gotohttp", "lateral movement", "lockbit", "longlegs", "nseckrnl", "ransomware", "sharepoint", "sharepoint exploitation", "storm-2603", "telecommunications", "tightvnc", "toolshell", "tunneling", "velociraptor", "vulnerable driver", "warlock", "water utility", "yuze" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--9d926212-2b2c-5bc7-b0fb-32e16a56d0d8", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.935Z", "created_at": "2026-10-03T03:32:12.645Z", "modified": "2026-10-03T08:16:14.238Z", "updated_at": "2026-10-03T08:16:14.238Z" }, "description_available": false, "entity_type": "Indicator", "id": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--6a04fee2-b53d-5e22-9458-244335b46526", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.954Z", "created_at": "2026-10-03T03:32:20.193Z", "modified": "2026-10-03T08:16:26.366Z", "updated_at": "2026-10-03T08:16:26.366Z" }, "description_available": false, "entity_type": "Indicator", "id": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--02ae31e8-35fe-513a-9323-b85348d0a587", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:32:06.078Z", "created_at": "2026-04-21T21:29:32.975Z", "modified": "2026-10-03T03:31:56.184Z", "updated_at": "2026-10-03T03:31:56.184Z" }, "description_available": false, "entity_type": "Indicator", "id": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "is_inferred": false, "labels": [ "black basta", "byovd", "cardinal", "cloudflare", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "cve-2025-68947", "defense evasion", "gotohttp", "lateral movement", "lockbit", "longlegs", "nseckrnl", "ransomware", "sharepoint", "sharepoint exploitation", "storm-2603", "telecommunications", "tightvnc", "toolshell", "tunneling", "velociraptor", "vulnerable driver", "warlock", "water utility", "yuze" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--de2160c5-f488-5c1d-806e-4f02e99de173", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:30.480Z", "updated_at": "2026-10-03T03:31:31.328Z" }, "description_available": false, "entity_type": "StixFile", "id": "705d578c-fd3f-4d04-979e-5aecfea019f7", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--46394e0a-7a8f-5728-8135-c42696cb2862", "type": "StixFile" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2025-07-08T17:15:58.250Z", "created_at": "2026-01-18T17:43:51.504Z", "modified": "2026-08-11T08:07:11.354Z", "updated_at": "2026-08-11T08:07:11.354Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "7311a7a0-c89a-4354-a1d6-757647f06178", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2025-49706", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "9bc2b937-d57d-4ea2-b84b-6f7a6a49601d", "source_name": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/" }, { "external_id": "CVE-2025-49706", "id": "f90d00ad-3278-4b53-bf66-35eec9f023ef", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49706" }, { "external_id": null, "id": "e2e67adf-0b49-4060-8e9b-36b769100751", "source_name": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "vulnerability--303364dc-51c9-5fdb-bec8-328d8f571748", "type": "Vulnerability" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:38.261Z", "updated_at": "2026-10-03T03:31:38.687Z" }, "description_available": false, "entity_type": "StixFile", "id": "73c99221-d365-4034-ad0e-072f05837c91", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--f75353fa-5788-57a3-84f2-981aff5bd725", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:49.996Z", "updated_at": "2026-10-03T03:31:50.514Z" }, "description_available": false, "entity_type": "StixFile", "id": "7ec09d08-ad13-4b7f-80c9-77a7fcad3c90", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--89fdca13-be3d-5b81-bc49-673454106de2", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.946Z", "created_at": "2026-10-03T03:32:16.645Z", "modified": "2026-10-03T08:16:19.964Z", "updated_at": "2026-10-03T08:16:19.964Z" }, "description_available": false, "entity_type": "Indicator", "id": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--0532bd67-03fb-5fd7-9a81-22d4d74efeea", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.926Z", "created_at": "2026-10-03T03:32:05.202Z", "modified": "2026-10-03T08:16:04.160Z", "updated_at": "2026-10-03T08:16:04.160Z" }, "description_available": false, "entity_type": "Indicator", "id": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--289d7a66-0db1-5663-98a7-d04b5d28e9d0", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:41.018Z", "updated_at": "2026-10-03T03:31:43.787Z" }, "description_available": false, "entity_type": "StixFile", "id": "8769ce71-6e98-40d5-b46b-d0a11e9904d0", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--8a78063b-9713-5c80-9cb6-bd988aea1137", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Natural Resources" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.389Z", "created_at": "2026-01-18T14:35:03.684Z", "modified": "2026-02-26T16:33:30.302Z", "updated_at": "2026-02-26T16:33:30.302Z" }, "description_available": true, "entity_type": "Sector", "id": "88a987fb-6fbd-444b-91ec-f52b5696e123", "is_inferred": false, "labels": [], "lang": "en", "name": "Energy", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "identity--166544e2-ba1f-5a6c-89cf-a63d0c01e91c", "type": "Sector" }, { "__typename": "Sector", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.388Z", "created_at": "2026-01-18T14:35:02.955Z", "modified": "2026-01-20T20:57:28.767Z", "updated_at": "2026-01-20T20:57:28.767Z" }, "description_available": true, "entity_type": "Sector", "id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "is_inferred": false, "labels": [], "lang": "en", "name": "Education", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "identity--2b0657c7-cf11-5d30-8867-4c6d9dd99270", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.951Z", "created_at": "2026-10-03T03:32:19.343Z", "modified": "2026-10-03T08:16:20.982Z", "updated_at": "2026-10-03T08:16:20.982Z" }, "description_available": false, "entity_type": "Indicator", "id": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--928e162a-2389-5110-919f-5b50001b8e1e", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:32.524Z", "updated_at": "2026-10-03T03:31:33.198Z" }, "description_available": false, "entity_type": "StixFile", "id": "8dbdb4bf-89e2-4edb-8603-1cbefecb0f2a", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--96b30dc0-2465-54f7-a1c5-2c71e3ee23dd", "type": "StixFile" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2025-07-20T23:15:31.807Z", "created_at": "2026-06-17T17:49:41.263Z", "modified": "2026-08-11T08:07:12.245Z", "updated_at": "2026-08-11T08:07:12.245Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2025-53771", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2025-53771", "id": "f327770b-2bd7-4c3a-b918-272127d2bfa9", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53771" }, { "external_id": null, "id": "961b2071-db90-4497-9d09-f3a41c163b41", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/" }, { "external_id": null, "id": "efc4834d-fb56-4bf7-9c87-03f3f925c60c", "source_name": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "vulnerability--bbb87aff-6b61-58c9-8439-1e844da73a95", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.921Z", "created_at": "2026-10-03T03:32:05.171Z", "modified": "2026-10-03T08:16:01.625Z", "updated_at": "2026-10-03T08:16:01.625Z" }, "description_available": false, "entity_type": "Indicator", "id": "931a6200-9113-400f-862a-00b2146badd8", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--31b2817d-b6b6-5241-a8df-4ebc963fd877", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:25:08.946Z", "created_at": "2026-08-09T19:50:32.176Z", "modified": "2026-08-09T19:50:38.715Z", "updated_at": "2026-08-09T19:50:38.715Z" }, "description_available": false, "entity_type": "Vulnerability", "id": "aa66b7a4-2d73-429d-adba-bd751a684724", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2025-1055", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2025-1055", "id": "56e212e9-3d12-4855-82b5-0181a5a73359", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1055" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "vulnerability--5572783f-f98f-5007-8f1e-8961f78ce73f", "type": "Vulnerability" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-04-21T21:29:20.797Z", "updated_at": "2026-10-03T03:31:28.707Z" }, "description_available": false, "entity_type": "StixFile", "id": "b0eb706a-b19f-498a-b468-d42a62ae81ba", "is_inferred": false, "labels": [ "black basta", "byovd", "cardinal", "cloudflare", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "cve-2025-68947", "defense evasion", "gotohttp", "lateral movement", "lockbit", "longlegs", "nseckrnl", "ransomware", "sharepoint", "sharepoint exploitation", "storm-2603", "telecommunications", "tightvnc", "toolshell", "tunneling", "velociraptor", "vulnerable driver", "warlock", "water utility", "yuze" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--581d70e4-0296-59d9-88a1-9ba0ab5c304a", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:38.266Z", "updated_at": "2026-10-03T03:31:38.688Z" }, "description_available": false, "entity_type": "StixFile", "id": "b8f53fa4-5df1-49e8-ab5a-12ecbd0343a9", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--12ad5f81-c453-52b3-8638-424183b1b353", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:46.862Z", "updated_at": "2026-10-03T03:31:47.431Z" }, "description_available": false, "entity_type": "StixFile", "id": "b9896c98-049c-46ab-b91d-322ed189c466", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--433408ef-7a34-5c7e-932a-0b54a07eb40e", "type": "StixFile" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2025-07-08T17:15:57.867Z", "created_at": "2026-01-18T17:43:41.998Z", "modified": "2026-08-11T08:07:11.379Z", "updated_at": "2026-08-11T08:07:11.379Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2025-49704", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "9bc2b937-d57d-4ea2-b84b-6f7a6a49601d", "source_name": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/" }, { "external_id": "CVE-2025-49704", "id": "ed54c4c8-5d36-445b-b21d-cdedcc7752bd", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49704" }, { "external_id": null, "id": "9fb2cd6f-6bba-4611-bf42-8e50e32155d0", "source_name": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "vulnerability--bc9e1ac7-3679-5067-8f57-d0586e65ecaf", "type": "Vulnerability" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:30.709Z", "updated_at": "2026-10-03T03:31:31.393Z" }, "description_available": false, "entity_type": "StixFile", "id": "c62e6a69-9e60-40c6-8682-aa59419f569c", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--3813bd50-faee-576f-9374-a6725d823c3a", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.948Z", "created_at": "2026-10-03T03:32:16.635Z", "modified": "2026-10-03T08:16:19.636Z", "updated_at": "2026-10-03T08:16:19.636Z" }, "description_available": false, "entity_type": "Indicator", "id": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--805f7873-780b-5e70-8405-d2ce57b7f9f6", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:46.851Z", "updated_at": "2026-10-03T03:31:47.429Z" }, "description_available": false, "entity_type": "StixFile", "id": "ce2686eb-ef3f-4546-b058-8fb9839c757c", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--30d3a890-b4a6-5657-98ce-0cb9b4d146ea", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.939Z", "created_at": "2026-10-03T03:32:12.668Z", "modified": "2026-10-03T08:16:11.094Z", "updated_at": "2026-10-03T08:16:11.094Z" }, "description_available": false, "entity_type": "Indicator", "id": "cf28624f-a664-4801-accf-d92c34364102", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--bc5255d6-8494-5d15-9094-2a4a74d9f5e6", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-04-21T21:29:25.256Z", "updated_at": "2026-10-03T03:31:29.947Z" }, "description_available": false, "entity_type": "StixFile", "id": "d35492f9-5612-4d12-943f-88772df08166", "is_inferred": false, "labels": [ "black basta", "byovd", "cardinal", "cloudflare", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "cve-2025-68947", "defense evasion", "gotohttp", "lateral movement", "lockbit", "longlegs", "nseckrnl", "ransomware", "sharepoint", "sharepoint exploitation", "storm-2603", "telecommunications", "tightvnc", "toolshell", "tunneling", "velociraptor", "vulnerable driver", "warlock", "water utility", "yuze" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--be74b500-2464-52b0-a9d1-5e60e40ec921", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:50.008Z", "updated_at": "2026-10-03T03:31:50.512Z" }, "description_available": false, "entity_type": "StixFile", "id": "d539be1e-e4bd-4059-95e1-5182c4824dc2", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--e3ae3efc-350d-50a4-a4b7-56aaf3c6a237", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.961Z", "created_at": "2026-10-03T03:32:26.568Z", "modified": "2026-10-03T08:16:37.703Z", "updated_at": "2026-10-03T08:16:37.703Z" }, "description_available": false, "entity_type": "Indicator", "id": "d80b334f-3e63-403a-9737-f6adceb87e9a", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--f72a05bf-4c7d-5d35-9a8f-fc4a47af48cf", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:41.005Z", "updated_at": "2026-10-03T03:31:43.785Z" }, "description_available": false, "entity_type": "StixFile", "id": "da35ab46-3781-4d05-add9-d933961580f4", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--4e6386c8-8981-5451-85d4-5b652f5b8f2a", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:50.018Z", "updated_at": "2026-10-03T03:31:50.510Z" }, "description_available": false, "entity_type": "StixFile", "id": "e11de47f-11df-4a0e-bf8a-4931e58fc8b5", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--1360fd99-98a5-5cb5-8cbe-8aa2add03653", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T03:31:30.812Z", "updated_at": "2026-10-03T03:31:31.395Z" }, "description_available": false, "entity_type": "StixFile", "id": "e82fda87-a856-4723-81a6-40eeae51ae99", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "file--e6190f49-e3b9-5f8a-a3db-b702c7680c41", "type": "StixFile" }, { "__typename": "AttackPattern", "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "entity_type": "Attack-Pattern", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "labels": [], "lang": "en", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "attack-pattern--be8b782f-8ecd-5dd6-817b-9a97173465ca", "type": "AttackPattern" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.943Z", "created_at": "2026-10-03T03:32:14.971Z", "modified": "2026-10-03T08:16:15.126Z", "updated_at": "2026-10-03T08:16:15.126Z" }, "description_available": false, "entity_type": "Indicator", "id": "eaaf924b-dda4-4f4f-9005-67309f56f272", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "indicator--678c3dcc-f520-5141-9111-d4d361140f9a", "type": "Indicator" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.783Z", "created_at": "2026-10-03T03:31:13.216Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-03T03:31:16.234Z", "updated_at": "2026-10-03T03:31:16.234Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "is_inferred": false, "labels": [], "lang": "en", "name": "Longlegs", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "intrusion-set--f6ac2e0b-0023-594a-8017-e02c23d34ef3", "type": "IntrusionSet" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2025-07-20T00:00:00.000Z", "created_at": "2026-01-18T17:43:57.932Z", "modified": "2026-08-08T20:28:08.258Z", "updated_at": "2026-08-08T20:28:08.258Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2025-53770", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "b6e44bad-658b-4af1-865f-dae2b084302c", "source_name": "Eye Research ToolShell JUL 2025", "url": "https://research.eye.security/sharepoint-under-siege/" }, { "external_id": "CVE-2025-53770", "id": "9bd0319a-f32b-42fe-99ad-611aefe1556b", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53770" }, { "external_id": null, "id": "6fbee70f-a606-4fab-8ee3-7f18db87ddaa", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/" }, { "external_id": null, "id": "0e195cd0-c43f-47ff-a90e-f37a4c47f35c", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/kaizensecurity/CVE-2025-53770" }, { "external_id": null, "id": "a08b9708-a635-4fc2-8f39-b2340c977a9b", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/" }, { "external_id": null, "id": "47da79d1-0867-44ba-9913-e3b47f2f85d0", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globally" }, { "external_id": null, "id": "961b2071-db90-4497-9d09-f3a41c163b41", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/" }, { "external_id": null, "id": "bc27b877-bf49-4ccf-9023-22552b5707b2", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770" }, { "external_id": null, "id": "6d026f57-fa34-4f25-bbfc-93b1898958fb", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flaw" }, { "external_id": null, "id": "4adb6bbe-481e-4a34-94f2-990dbbfe0d2c", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/" }, { "external_id": null, "id": "df4a9bbb-8caf-435e-8823-72d6cb816df9", "source_name": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://x.com/Shadowserver/status/1946900837306868163" }, { "external_id": null, "id": "119b1f20-daea-4b16-bd25-9bbbb6373e56", "source_name": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "vulnerability--6e631e19-e567-5cbb-8dd6-e8e8a817b3fd", "type": "Vulnerability" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.937Z", "created_at": "2026-10-03T03:38:43.866Z", "modified": "2026-10-03T03:38:44.419Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:44.419Z" }, "description_available": false, "entity_type": "based-on", "fromId": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_id": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_name": null, "from_type": "Indicator", "id": "034fcf71-0ea6-45d7-abe9-88cce6de674b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--774d1e06-7eb9-5983-9e58-566be4a3917d", "toId": "378c1f0d-6075-4444-9105-c34dbb7f0ad0", "to_id": "378c1f0d-6075-4444-9105-c34dbb7f0ad0", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.834Z", "created_at": "2026-10-03T03:35:39.789Z", "modified": "2026-10-03T03:35:42.193Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:42.193Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "049c63df-d6a2-42a3-b08e-f14eccd60fd3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--fa3af65e-9cb4-5eb5-b257-bba04082c104", "toId": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "to_id": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "to_name": "CVE-2025-53770", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.952Z", "created_at": "2026-10-03T03:38:47.765Z", "modified": "2026-10-03T03:38:48.488Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:48.488Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_id": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_name": null, "from_type": "Indicator", "id": "04c8408e-eacb-4ffc-907f-ca66f2527ff4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--7f14501b-81fd-504e-b1ae-233e2decb7fd", "toId": "09216b18-95cf-459b-a0cb-3e230f14d370", "to_id": "09216b18-95cf-459b-a0cb-3e230f14d370", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.918Z", "created_at": "2026-10-03T03:38:41.844Z", "modified": "2026-10-03T03:38:42.486Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:42.486Z" }, "description_available": false, "entity_type": "based-on", "fromId": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_id": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_name": null, "from_type": "Indicator", "id": "07eb62ee-6bcd-4cb8-8d35-c7e8bdbfcffe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--b4e368c4-ad47-5513-9e08-9e0ab7b065b8", "toId": "37fc5e02-0c8b-49f8-a220-ad5ed23f4edb", "to_id": "37fc5e02-0c8b-49f8-a220-ad5ed23f4edb", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.928Z", "created_at": "2026-10-03T03:38:43.388Z", "modified": "2026-10-03T03:38:43.914Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:43.914Z" }, "description_available": false, "entity_type": "based-on", "fromId": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_id": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_name": null, "from_type": "Indicator", "id": "09cf9e20-fe8c-4004-bf4d-b80a0a5ef681", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--61dd8d04-f550-5f61-a805-cfd2eee25030", "toId": "8dbdb4bf-89e2-4edb-8603-1cbefecb0f2a", "to_id": "8dbdb4bf-89e2-4edb-8603-1cbefecb0f2a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.836Z", "created_at": "2026-10-03T03:35:44.892Z", "modified": "2026-10-03T03:35:52.323Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:52.323Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "09e1fa62-6124-4c77-800b-032f927d6756", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--901c0be1-8dc7-5b63-b4bd-cc1cf9343c87", "toId": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "to_id": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "to_name": "CVE-2025-49704", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.124Z", "created_at": "2026-10-03T03:58:49.552Z", "modified": "2026-10-03T03:58:50.045Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:58:50.045Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_id": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_name": null, "from_type": "Indicator", "id": "0d056833-8ded-4adb-bfdc-92b5881e8733", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--2818de27-e092-5edf-af35-22ae33421cae", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.958Z", "created_at": "2026-10-03T03:38:50.222Z", "modified": "2026-10-03T03:38:51.307Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:51.307Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_id": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_name": null, "from_type": "Indicator", "id": "14022a6d-7d25-4312-b303-e152e2e99a49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--08514655-a885-512e-84a8-5728fd4d24c3", "toId": "b9896c98-049c-46ab-b91d-322ed189c466", "to_id": "b9896c98-049c-46ab-b91d-322ed189c466", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.136Z", "created_at": "2026-10-03T04:00:01.916Z", "modified": "2026-10-03T04:00:02.684Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:00:02.684Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_id": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_name": null, "from_type": "Indicator", "id": "14dd8818-234a-485f-b8aa-74890087300c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--01565390-850f-5ef9-bfd8-2908dcc7e73b", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.114Z", "created_at": "2026-10-03T03:57:25.788Z", "modified": "2026-10-03T03:57:27.341Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:57:27.341Z" }, "description_available": false, "entity_type": "indicates", "fromId": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_id": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_name": null, "from_type": "Indicator", "id": "15af5fb3-38d0-463d-a4d1-12cbd49bb19a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--17e899cb-aa3e-5f54-aca6-afaab116ee34", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.111Z", "created_at": "2026-10-03T03:56:56.637Z", "modified": "2026-10-03T03:56:57.473Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:56:57.473Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_id": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_name": null, "from_type": "Indicator", "id": "16acb7f5-f66c-4986-ad33-33de86ff71b0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--a650a440-0e0d-5915-93ee-ec5f5aa33ce8", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.257Z", "created_at": "2026-10-03T04:07:12.955Z", "modified": "2026-10-03T04:07:18.329Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:07:18.329Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_id": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_name": null, "from_type": "Indicator", "id": "16f463a8-3780-4b1a-b21a-483aa6d622ef", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--aa61bbb0-ed0f-5120-999c-977d0d564da3", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.228Z", "created_at": "2026-10-03T04:03:21.685Z", "modified": "2026-10-03T04:03:25.148Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:03:25.148Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_id": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_name": null, "from_type": "Indicator", "id": "177dada6-ab13-42ac-a3dc-f5ffafc480a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--911e26b4-f7f7-5b85-aa20-b0b0cb99ad7e", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.249Z", "created_at": "2026-10-03T04:05:38.294Z", "modified": "2026-10-03T04:05:40.770Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:05:40.770Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_id": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_name": null, "from_type": "Indicator", "id": "1baef1fe-c4ed-4563-8ee5-95ef6be58161", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--093b2064-7042-5f38-aeca-e892bbb696ca", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:32:06.073Z", "created_at": "2026-04-21T21:32:45.261Z", "modified": "2026-04-21T21:32:46.772Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T21:32:46.772Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_id": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_name": null, "from_type": "Indicator", "id": "1cd6281b-0391-403c-bfac-5df16b7bda18", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--de34a663-991e-5664-887f-48f25911f320", "toId": "b0eb706a-b19f-498a-b468-d42a62ae81ba", "to_id": "b0eb706a-b19f-498a-b468-d42a62ae81ba", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.987Z", "created_at": "2026-10-03T03:40:06.092Z", "modified": "2026-10-03T03:40:16.487Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:40:16.487Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_id": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_name": null, "from_type": "Indicator", "id": "214459fe-7304-4797-a277-540fb8e5d246", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--4c6ec292-a2ba-57c8-8722-ae4b10a5d18e", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.122Z", "created_at": "2026-10-03T03:58:37.569Z", "modified": "2026-10-03T03:58:39.659Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:58:39.659Z" }, "description_available": false, "entity_type": "indicates", "fromId": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_id": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_name": null, "from_type": "Indicator", "id": "252d7cea-407e-40ad-91f3-88d1761b168c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--7b623c97-f94b-507c-9161-6e041ab55b64", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.941Z", "created_at": "2026-10-03T03:38:44.710Z", "modified": "2026-10-03T03:38:46.694Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:46.694Z" }, "description_available": false, "entity_type": "based-on", "fromId": "cf28624f-a664-4801-accf-d92c34364102", "from_id": "cf28624f-a664-4801-accf-d92c34364102", "from_name": null, "from_type": "Indicator", "id": "256a1931-fc46-40ab-84b6-fe58a8035951", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--51cffdc4-e790-599c-9dc4-b9b44565e950", "toId": "73c99221-d365-4034-ad0e-072f05837c91", "to_id": "73c99221-d365-4034-ad0e-072f05837c91", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.833Z", "created_at": "2026-10-03T03:35:36.364Z", "modified": "2026-10-03T03:35:38.010Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:38.010Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "2ac3f6da-336b-4a21-b209-b327779b5f60", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--d6e5eacc-cb51-5e76-8251-5a2c2c7b4c60", "toId": "7311a7a0-c89a-4354-a1d6-757647f06178", "to_id": "7311a7a0-c89a-4354-a1d6-757647f06178", "to_name": "CVE-2025-49706", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.114Z", "created_at": "2026-10-03T03:57:51.714Z", "modified": "2026-10-03T03:57:53.403Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:57:53.403Z" }, "description_available": false, "entity_type": "indicates", "fromId": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_id": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_name": null, "from_type": "Indicator", "id": "2c192d4a-c75e-4d93-ab67-e9234891dd57", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--46760f14-0297-524d-a5d1-6ea2d3c822de", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.227Z", "created_at": "2026-10-03T04:01:53.373Z", "modified": "2026-10-03T04:01:54.761Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:01:54.761Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_id": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_name": null, "from_type": "Indicator", "id": "2c32e962-0429-4318-8e53-9364a182baca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--49de9c8f-b5ec-5c07-9ddc-8d149113779b", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.246Z", "created_at": "2026-10-03T04:05:14.499Z", "modified": "2026-10-03T04:05:19.703Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:05:19.703Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_id": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_name": null, "from_type": "Indicator", "id": "2cd5e630-50b4-49c1-80df-ab466fedcef8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--f8d81b94-e5c1-5f47-98ce-2cddc7fbcad2", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.214Z", "created_at": "2026-10-03T04:00:49.983Z", "modified": "2026-10-03T04:00:51.253Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:00:51.253Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_id": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_name": null, "from_type": "Indicator", "id": "2fe6528f-28f0-4cdc-9546-f151ad311b38", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--d504557d-dbc6-5dfd-bbc6-fbc2eb21d8fa", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.827Z", "created_at": "2026-10-03T03:32:31.167Z", "modified": "2026-10-03T03:32:33.890Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:32:33.890Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "354df13e-c60d-4aa0-bfac-7f45dafd1cd7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--55c6c8ff-7ab9-5111-8483-c4608106a64f", "toId": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_name": "Telecommunications", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.225Z", "created_at": "2026-10-03T04:01:37.479Z", "modified": "2026-10-03T04:01:41.039Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:01:41.039Z" }, "description_available": false, "entity_type": "indicates", "fromId": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_id": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_name": null, "from_type": "Indicator", "id": "35c0f761-4481-4634-be0c-1331e6cfb5c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--83db80fe-accd-51d3-82a4-207a0bbb34c5", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.260Z", "created_at": "2026-10-03T04:07:08.042Z", "modified": "2026-10-03T04:07:10.179Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:07:10.179Z" }, "description_available": false, "entity_type": "indicates", "fromId": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_id": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_name": null, "from_type": "Indicator", "id": "366f969d-6f2b-4282-bd5a-32a7781f2683", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--d2b9e327-7ee9-58f6-92bf-775bf7b98b4a", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.272Z", "created_at": "2026-10-03T04:08:05.725Z", "modified": "2026-10-03T04:08:07.989Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:08:07.989Z" }, "description_available": false, "entity_type": "indicates", "fromId": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_id": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_name": null, "from_type": "Indicator", "id": "36be355a-675b-4774-bc34-3460fc646e10", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--3e8cd9ce-36fc-5adf-ba83-c49fab53b391", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.979Z", "created_at": "2026-10-03T03:39:42.404Z", "modified": "2026-10-03T03:39:44.789Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:39:44.789Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_id": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_name": null, "from_type": "Indicator", "id": "381444a2-f16e-4198-b368-9c81c70b491f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--d2b8ded9-c2ea-59d8-b8b2-21245625f5c8", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.238Z", "created_at": "2026-10-03T04:03:58.442Z", "modified": "2026-10-03T04:03:58.948Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:03:58.948Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_id": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_name": null, "from_type": "Indicator", "id": "39d4c304-51ba-4f7b-8895-316b76f26b49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--bb51bcaa-fb8a-59fa-9d60-217149fd3f4b", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.125Z", "created_at": "2026-10-03T03:58:50.826Z", "modified": "2026-10-03T03:58:51.673Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:58:51.673Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_id": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_name": null, "from_type": "Indicator", "id": "3abb4cae-6f2d-4fd7-a108-ba51cbc42078", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--f69b0d64-a69d-5ee4-a5d8-e4bf125ca440", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.835Z", "created_at": "2026-10-03T03:35:43.373Z", "modified": "2026-10-03T03:35:52.321Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:52.321Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "3b34f54b-0fd1-4caa-9471-1ef3c2a5e946", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--dd80bd08-34fe-5730-8320-b0822d60f4c2", "toId": "aa66b7a4-2d73-429d-adba-bd751a684724", "to_id": "aa66b7a4-2d73-429d-adba-bd751a684724", "to_name": "CVE-2025-1055", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.833Z", "created_at": "2026-10-03T03:35:32.175Z", "modified": "2026-10-03T03:35:34.769Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:34.769Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "3b9c2dcd-b466-4b7b-8cfa-e5be0c3c4651", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--888f5e36-aeb1-53b7-8431-c98bad8878c6", "toId": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "to_id": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "to_name": "CVE-2025-49704", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.032Z", "created_at": "2026-10-03T03:45:30.465Z", "modified": "2026-10-03T03:45:31.487Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:45:31.487Z" }, "description_available": false, "entity_type": "indicates", "fromId": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_id": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_name": null, "from_type": "Indicator", "id": "3e047142-dcee-4fb5-8244-d83725d07be3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--d346e406-6621-5b67-b86b-fc4876fcd01c", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.976Z", "created_at": "2026-10-03T03:39:15.394Z", "modified": "2026-10-03T03:39:17.143Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:39:17.143Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_id": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_name": null, "from_type": "Indicator", "id": "3e298610-1da1-4b82-9618-37f4007bdf30", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--b470a83e-7f53-5640-a132-65a9bf766630", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.000Z", "created_at": "2026-10-03T03:41:35.081Z", "modified": "2026-10-03T03:41:39.547Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:41:39.547Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_id": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_name": null, "from_type": "Indicator", "id": "3eef3934-e3a6-46d3-ba5e-61db19a5690d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--aa1b2a3d-b9b6-51d0-920e-3cff76af5866", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.955Z", "created_at": "2026-10-03T03:38:48.190Z", "modified": "2026-10-03T03:38:48.993Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:48.993Z" }, "description_available": false, "entity_type": "based-on", "fromId": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_id": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_name": null, "from_type": "Indicator", "id": "405d1447-e6eb-40ec-9464-1189544e74cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--84855ddb-337e-52af-8b0f-53b29989c47a", "toId": "ce2686eb-ef3f-4546-b058-8fb9839c757c", "to_id": "ce2686eb-ef3f-4546-b058-8fb9839c757c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.837Z", "created_at": "2026-10-03T03:35:56.123Z", "modified": "2026-10-03T03:35:57.328Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:57.328Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "478d98bd-b358-4a83-bcb4-f1dc0bdededc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--1e95ae5b-4524-5fe1-80b8-a0bc9588679a", "toId": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "to_id": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "to_name": "CVE-2025-53770", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.828Z", "created_at": "2026-10-03T03:32:36.231Z", "modified": "2026-10-03T03:32:36.921Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:32:36.921Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "4d48c25f-7ffa-4200-99bd-fe754b56e6cf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--84c4d00b-3375-515e-8fe9-6f07b8722e55", "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_name": "Education", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.021Z", "created_at": "2026-10-03T03:44:35.448Z", "modified": "2026-10-03T03:44:36.828Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:44:36.828Z" }, "description_available": false, "entity_type": "indicates", "fromId": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_id": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_name": null, "from_type": "Indicator", "id": "547f2a50-22d6-4008-8bdd-f3ba6505640f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--b0942a33-86b9-5a25-ad2c-70d1783e9a20", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.217Z", "created_at": "2026-10-03T04:01:07.467Z", "modified": "2026-10-03T04:01:08.742Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:01:08.742Z" }, "description_available": false, "entity_type": "indicates", "fromId": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_id": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_name": null, "from_type": "Indicator", "id": "5608f015-679e-4c0d-9840-e5996c892371", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--2f51f30c-7d6a-54f8-8ad7-ac63099550b9", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:25:08.990Z", "created_at": "2026-08-09T19:59:55.232Z", "modified": "2026-08-09T19:59:58.489Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-09T19:59:58.489Z" }, "description_available": false, "entity_type": "targets", "fromId": "ea4de683-0cad-4497-a044-65b61045d534", "from_id": "ea4de683-0cad-4497-a044-65b61045d534", "from_name": "T1574.002", "from_type": "AttackPattern", "id": "5999d507-9667-4a01-9dfe-1690edf52594", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--3351995f-4e2a-5748-8c92-8aa4bd407bf8", "toId": "aa66b7a4-2d73-429d-adba-bd751a684724", "to_id": "aa66b7a4-2d73-429d-adba-bd751a684724", "to_name": "CVE-2025-1055", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.882Z", "created_at": "2026-10-03T03:38:13.098Z", "modified": "2026-10-03T03:38:14.716Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:14.716Z" }, "description_available": false, "entity_type": "targets", "fromId": "ea4de683-0cad-4497-a044-65b61045d534", "from_id": "ea4de683-0cad-4497-a044-65b61045d534", "from_name": "T1574.002", "from_type": "AttackPattern", "id": "5de2f660-9bca-437b-81a5-00ef515b6770", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--69fd67b2-81d2-53e9-9053-2df7cef1b0a7", "toId": "7311a7a0-c89a-4354-a1d6-757647f06178", "to_id": "7311a7a0-c89a-4354-a1d6-757647f06178", "to_name": "CVE-2025-49706", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.081Z", "created_at": "2026-10-03T03:52:48.673Z", "modified": "2026-10-03T03:52:49.496Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:52:49.496Z" }, "description_available": false, "entity_type": "indicates", "fromId": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_id": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_name": null, "from_type": "Indicator", "id": "6355e330-0e55-4341-bffe-9acd001c3b21", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--7157d051-f8aa-5c1c-be8f-b423c1086266", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.944Z", "created_at": "2026-10-03T03:38:44.706Z", "modified": "2026-10-03T03:38:46.696Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:46.696Z" }, "description_available": false, "entity_type": "based-on", "fromId": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_id": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_name": null, "from_type": "Indicator", "id": "65554cb5-f67c-4448-b0c9-8a1f2ba6e47c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--9af2571d-1c5e-512f-9617-c2b573759f43", "toId": "8769ce71-6e98-40d5-b46b-d0a11e9904d0", "to_id": "8769ce71-6e98-40d5-b46b-d0a11e9904d0", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.838Z", "created_at": "2026-10-03T03:35:58.252Z", "modified": "2026-10-03T03:35:59.276Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:59.276Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "6ad7f600-95fc-4c54-ac73-98438ce215ec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--642bf24c-b39e-5937-b58f-8c41c8943ba0", "toId": "aa66b7a4-2d73-429d-adba-bd751a684724", "to_id": "aa66b7a4-2d73-429d-adba-bd751a684724", "to_name": "CVE-2025-1055", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.991Z", "created_at": "2026-10-03T03:41:05.679Z", "modified": "2026-10-03T03:41:07.849Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:41:07.849Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_id": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_name": null, "from_type": "Indicator", "id": "6ce3cb43-16ee-49a9-b126-3bc50a76318e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--0ff5ed49-a7fb-50d7-a1b5-7e48e80b671a", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.947Z", "created_at": "2026-10-03T03:38:46.470Z", "modified": "2026-10-03T03:38:47.361Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:47.361Z" }, "description_available": false, "entity_type": "based-on", "fromId": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_id": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "from_name": null, "from_type": "Indicator", "id": "6df2f00b-6d82-48a4-a58d-1a8cd6d8ee27", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--b4b29227-b273-5467-9f12-ad01acc4586b", "toId": "da35ab46-3781-4d05-add9-d933961580f4", "to_id": "da35ab46-3781-4d05-add9-d933961580f4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.092Z", "created_at": "2026-10-03T03:53:46.780Z", "modified": "2026-10-03T03:53:47.792Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:53:47.792Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cf28624f-a664-4801-accf-d92c34364102", "from_id": "cf28624f-a664-4801-accf-d92c34364102", "from_name": null, "from_type": "Indicator", "id": "7071feba-b421-4f30-a270-3f52013b9a4f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--2f2e40fb-6d45-5d54-9a38-b1832404ed29", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.967Z", "created_at": "2026-10-03T03:38:52.287Z", "modified": "2026-10-03T03:38:53.710Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:53.710Z" }, "description_available": false, "entity_type": "based-on", "fromId": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_id": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_name": null, "from_type": "Indicator", "id": "741370e4-0bd0-4299-ae5b-3ec3f7c1fa97", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--5d58b43f-ad1e-5f1c-82a9-d2cd767d64c8", "toId": "d539be1e-e4bd-4059-95e1-5182c4824dc2", "to_id": "d539be1e-e4bd-4059-95e1-5182c4824dc2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.909Z", "created_at": "2026-10-03T03:38:40.255Z", "modified": "2026-10-03T03:38:41.495Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:41.495Z" }, "description_available": false, "entity_type": "based-on", "fromId": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_id": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_name": null, "from_type": "Indicator", "id": "76c0a2ce-043b-4e48-91ae-895046f71449", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--2ea5d413-be5a-58bd-b828-c1ac781a24af", "toId": "c62e6a69-9e60-40c6-8682-aa59419f569c", "to_id": "c62e6a69-9e60-40c6-8682-aa59419f569c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.830Z", "created_at": "2026-10-03T03:32:37.652Z", "modified": "2026-10-03T03:32:39.699Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:32:39.699Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "773c0526-5202-484f-86f7-c91950a06915", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--265e913a-845e-54d5-af8c-078653437f3a", "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_name": "Education", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.217Z", "created_at": "2026-10-03T04:01:09.501Z", "modified": "2026-10-03T04:01:09.978Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:01:09.978Z" }, "description_available": false, "entity_type": "indicates", "fromId": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_id": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "from_name": null, "from_type": "Indicator", "id": "77afb6da-72e8-41db-af17-abc7399662f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--b58a6bbf-c1db-5417-afcb-88848be18266", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.060Z", "created_at": "2026-10-03T03:48:52.980Z", "modified": "2026-10-03T03:48:53.710Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:48:53.710Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_id": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_name": null, "from_type": "Indicator", "id": "7cb02feb-ca61-4510-9e3b-ab5151fa223e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--ffedd0c9-1ac6-5a38-b33a-d6fe4aa7cd36", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.969Z", "created_at": "2026-10-03T03:38:56.660Z", "modified": "2026-10-03T03:38:57.331Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:57.331Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_id": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_name": null, "from_type": "Indicator", "id": "7dc23921-0ffb-4ab3-9922-86f625717122", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--63396d4f-819a-5ee3-b532-76a04dd796d1", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.048Z", "created_at": "2026-10-03T03:47:49.029Z", "modified": "2026-10-03T03:47:49.781Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:47:49.781Z" }, "description_available": false, "entity_type": "indicates", "fromId": "931a6200-9113-400f-862a-00b2146badd8", "from_id": "931a6200-9113-400f-862a-00b2146badd8", "from_name": null, "from_type": "Indicator", "id": "7fb2928a-4a6e-404d-8c05-974e689e3cac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--f35db1aa-9e8c-54b3-85fb-413cdc35ff83", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.968Z", "created_at": "2026-10-03T03:38:52.285Z", "modified": "2026-10-03T03:38:53.708Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:53.708Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_id": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_name": null, "from_type": "Indicator", "id": "7fe7ee9b-76b4-41a6-9ca2-985b78fabf2c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--fef96dd7-23df-584a-bd54-dd3d8f215e65", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T23:25:16.413Z", "created_at": "2026-04-10T21:02:13.102Z", "modified": "2026-04-10T21:02:13.887Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-10T21:02:13.887Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "84156d1b-c078-4475-80ad-7d7c8d2ee5d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--b1c7f738-fb10-5776-a562-d0cdb1d795ed", "toId": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_id": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_name": "Energy", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T23:25:16.336Z", "created_at": "2026-04-10T21:04:45.718Z", "modified": "2026-04-10T21:04:45.988Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-10T21:04:45.988Z" }, "description_available": false, "entity_type": "uses", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "86d9b4ae-33ca-4410-b63b-db948e64e85e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--864fd28d-bec4-5b3f-a3ef-0fc6ebca8e03", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T23:25:16.414Z", "created_at": "2026-04-10T21:02:23.518Z", "modified": "2026-04-10T21:02:25.028Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-10T21:02:25.028Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "89dc71d8-6654-4545-a887-c3dea2892dd6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--916eaf5f-260e-59ca-a8cc-bebe85ddd6ec", "toId": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_name": "Telecommunications", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.047Z", "created_at": "2026-10-03T03:47:47.691Z", "modified": "2026-10-03T03:47:48.270Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:47:48.270Z" }, "description_available": false, "entity_type": "indicates", "fromId": "931a6200-9113-400f-862a-00b2146badd8", "from_id": "931a6200-9113-400f-862a-00b2146badd8", "from_name": null, "from_type": "Indicator", "id": "8bf65550-3b2b-4b90-adf0-41d7c97487d5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--aaa9d730-a5eb-5125-a942-f642438e939a", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.960Z", "created_at": "2026-10-03T03:38:50.221Z", "modified": "2026-10-03T03:38:51.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:51.305Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_id": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_name": null, "from_type": "Indicator", "id": "8df49a84-bbc7-47a2-af04-4b8eb3bc994e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--db20e1c1-dceb-585f-930d-b8088c02a39f", "toId": "7ec09d08-ad13-4b7f-80c9-77a7fcad3c90", "to_id": "7ec09d08-ad13-4b7f-80c9-77a7fcad3c90", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.036Z", "created_at": "2026-10-03T03:45:43.971Z", "modified": "2026-10-03T03:45:47.342Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:45:47.342Z" }, "description_available": false, "entity_type": "indicates", "fromId": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_id": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_name": null, "from_type": "Indicator", "id": "922c5282-1d5b-4b98-bad0-6c81db563232", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--16afcc19-a4ce-599e-89d6-1c7da377b0a6", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.826Z", "created_at": "2026-10-03T03:32:29.931Z", "modified": "2026-10-03T03:32:30.329Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:32:30.329Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "92966325-a3c5-4211-9676-968fa236c567", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--34770aa1-8114-5800-9175-3aeb83e5be4d", "toId": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_id": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_name": "Energy", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.102Z", "created_at": "2026-10-03T03:54:47.987Z", "modified": "2026-10-03T03:54:53.085Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:54:53.085Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_id": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_name": null, "from_type": "Indicator", "id": "93c9df5b-52bc-4b4b-ab18-576b4aec9b35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--62c2c8e6-f1be-551c-858a-bf330e7df12d", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.082Z", "created_at": "2026-10-03T03:53:01.036Z", "modified": "2026-10-03T03:53:02.072Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:53:02.072Z" }, "description_available": false, "entity_type": "indicates", "fromId": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_id": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_name": null, "from_type": "Indicator", "id": "93fb875e-71a1-4371-8397-421b5672d6c3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--d6827e0f-8f56-5c0d-b2f2-c57b6d51b23f", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.056Z", "created_at": "2026-10-03T03:48:21.952Z", "modified": "2026-10-03T03:48:28.810Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:48:28.810Z" }, "description_available": false, "entity_type": "indicates", "fromId": "931a6200-9113-400f-862a-00b2146badd8", "from_id": "931a6200-9113-400f-862a-00b2146badd8", "from_name": null, "from_type": "Indicator", "id": "95864d48-fb0a-4325-9f48-b3ebf59ede35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--286cc21b-2189-5d60-b78e-b8e8dd3850a0", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.071Z", "created_at": "2026-10-03T03:51:23.000Z", "modified": "2026-10-03T03:51:27.793Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:51:27.793Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_id": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_name": null, "from_type": "Indicator", "id": "98e11921-e5a4-4c2f-a9dd-e1f7dc6a4e45", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--7fca832d-6184-5c2e-aaa5-f1bb74e7d36f", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.836Z", "created_at": "2026-10-03T03:36:01.207Z", "modified": "2026-10-03T03:36:03.784Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:36:03.784Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "99919f32-a643-4ec9-b854-caa1a229569f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--1e3ea678-3d07-569c-839b-586f507351c0", "toId": "7311a7a0-c89a-4354-a1d6-757647f06178", "to_id": "7311a7a0-c89a-4354-a1d6-757647f06178", "to_name": "CVE-2025-49706", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.068Z", "created_at": "2026-10-03T03:51:23.067Z", "modified": "2026-10-03T03:51:27.795Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:51:27.795Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_id": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_name": null, "from_type": "Indicator", "id": "9ab64762-ce5b-47f8-9004-d8cd91ddb0a3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--1f868579-b3b1-5746-ad57-8c636e9b76d3", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.249Z", "created_at": "2026-10-03T04:05:33.851Z", "modified": "2026-10-03T04:05:35.995Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:05:35.995Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_id": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_name": null, "from_type": "Indicator", "id": "a1ea31a9-231e-4d58-a4f8-6f84260d9576", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--4bb1cbe7-2029-5e26-af10-6af05fca7649", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.827Z", "created_at": "2026-10-03T03:32:37.754Z", "modified": "2026-10-03T03:32:39.698Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:32:39.698Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "a4ffbe81-0825-449b-b1e7-a4ae84e61aca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--c2957414-b832-5b13-984c-6a9aaa64e7bb", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.014Z", "created_at": "2026-10-03T03:43:36.728Z", "modified": "2026-10-03T03:43:39.154Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:43:39.154Z" }, "description_available": false, "entity_type": "indicates", "fromId": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_id": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_name": null, "from_type": "Indicator", "id": "a54203cb-64d5-4783-a294-8ade45cc6c3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--f0f274c0-02e1-5729-a97c-a4416ebad993", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.035Z", "created_at": "2026-10-03T03:45:41.204Z", "modified": "2026-10-03T03:45:42.487Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:45:42.487Z" }, "description_available": false, "entity_type": "indicates", "fromId": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_id": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_name": null, "from_type": "Indicator", "id": "a83412af-01b4-4977-a285-c3e3775dc5fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--eaa722ac-2989-5502-826a-8c9e56c6a23b", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.811Z", "created_at": "2026-10-03T03:33:58.901Z", "modified": "2026-10-03T03:33:59.545Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:33:59.545Z" }, "description_available": false, "entity_type": "uses", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--6ec506ca-825f-535b-a168-f7a88814978c", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.013Z", "created_at": "2026-10-03T03:43:32.535Z", "modified": "2026-10-03T03:43:34.448Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:43:34.448Z" }, "description_available": false, "entity_type": "indicates", "fromId": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_id": "42725fae-afa8-41bf-a870-ec24ff40e37b", "from_name": null, "from_type": "Indicator", "id": "a973eafd-f5f7-4b4e-a5c4-685ad5e80034", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--7ef3ca22-1163-5c37-aa07-7dc213ee4b25", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.950Z", "created_at": "2026-10-03T03:38:47.783Z", "modified": "2026-10-03T03:38:48.482Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:48.482Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_id": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_name": null, "from_type": "Indicator", "id": "b0119374-5b6b-4e99-b5ff-7f26d59dc868", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--3a17c6c4-7c8d-5015-bdd1-b59e3a930e3b", "toId": "11e839e3-249d-4f53-a46e-58c8ac1911b2", "to_id": "11e839e3-249d-4f53-a46e-58c8ac1911b2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.963Z", "created_at": "2026-10-03T03:38:50.730Z", "modified": "2026-10-03T03:38:52.011Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:52.011Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_id": "d80b334f-3e63-403a-9737-f6adceb87e9a", "from_name": null, "from_type": "Indicator", "id": "b18a094d-647b-4b9e-adae-f6766051c329", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--4eccd19e-ef82-53a2-b865-a82cb87f64c8", "toId": "e11de47f-11df-4a0e-bf8a-4931e58fc8b5", "to_id": "e11de47f-11df-4a0e-bf8a-4931e58fc8b5", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.044Z", "created_at": "2026-10-03T03:47:02.955Z", "modified": "2026-10-03T03:47:12.000Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:47:12.000Z" }, "description_available": false, "entity_type": "indicates", "fromId": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_id": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "from_name": null, "from_type": "Indicator", "id": "b3a6aefe-0519-4670-b9dd-9331bca9dede", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--9b7ff3f2-94bd-59ee-96f7-eb3ab99ed552", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.059Z", "created_at": "2026-10-03T03:48:51.144Z", "modified": "2026-10-03T03:48:52.257Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:48:52.257Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_id": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "from_name": null, "from_type": "Indicator", "id": "b75304e3-09f1-40e9-9cfd-bcc3f7da1aa8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--d4ff3c9b-83b3-5366-a1d7-574d0a316e91", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.881Z", "created_at": "2026-10-03T03:38:01.896Z", "modified": "2026-10-03T03:38:03.096Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:03.096Z" }, "description_available": false, "entity_type": "targets", "fromId": "ea4de683-0cad-4497-a044-65b61045d534", "from_id": "ea4de683-0cad-4497-a044-65b61045d534", "from_name": "T1574.002", "from_type": "AttackPattern", "id": "b8451d92-0980-49e9-9cbb-670db94d6af9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--df586230-c91b-578e-a56a-af4a20f41f04", "toId": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "to_id": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "to_name": "CVE-2025-49704", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.024Z", "created_at": "2026-10-03T03:44:59.777Z", "modified": "2026-10-03T03:45:01.109Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:45:01.109Z" }, "description_available": false, "entity_type": "indicates", "fromId": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_id": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_name": null, "from_type": "Indicator", "id": "b92f62ef-abc2-46fd-80af-c0944e311303", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--8f02cdd7-d8a2-53f3-9137-ef0d9ca2acfe", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.079Z", "created_at": "2026-10-03T03:52:33.614Z", "modified": "2026-10-03T03:52:34.772Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:52:34.772Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_id": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_name": null, "from_type": "Indicator", "id": "b95f97d9-0f84-4a0c-abe6-3b2747e528b5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--63611fab-ecbf-5e45-b779-d07ce0d67097", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.990Z", "created_at": "2026-10-03T03:40:34.867Z", "modified": "2026-10-03T03:40:40.384Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:40:40.384Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_id": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_name": null, "from_type": "Indicator", "id": "b96f024b-6f18-4140-a44e-a5c0bc4f224e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--89190493-2354-5c43-a57a-d680874e50e0", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:32:06.080Z", "created_at": "2026-04-21T21:32:47.425Z", "modified": "2026-04-21T21:32:47.958Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T21:32:47.958Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_id": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "from_name": null, "from_type": "Indicator", "id": "ba1cb95f-df5c-49a6-9ab6-a3f516472dc3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--1317b09a-1ebe-5d11-b14b-966319eb8fd6", "toId": "19eaba70-a8ba-4ff6-8f34-7ba4b521a1e9", "to_id": "19eaba70-a8ba-4ff6-8f34-7ba4b521a1e9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.011Z", "created_at": "2026-10-03T03:43:02.040Z", "modified": "2026-10-03T03:43:07.294Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:43:07.294Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a7a9789-0adc-4b87-b716-133383803962", "from_id": "1a7a9789-0adc-4b87-b716-133383803962", "from_name": null, "from_type": "Indicator", "id": "bac55aa4-0382-4ad7-aa1d-b3aa78b9c896", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--1219bddd-cf49-5946-a6e7-c3d0170103b1", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.834Z", "created_at": "2026-10-03T03:35:55.157Z", "modified": "2026-10-03T03:35:56.374Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:35:56.374Z" }, "description_available": false, "entity_type": "targets", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "bc7e8b44-7305-445a-af82-6c6541316d9d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--95c14c47-34a0-5990-ab07-4d5fe0e57099", "toId": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "to_id": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "to_name": "CVE-2025-53771", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.785Z", "created_at": "2026-10-03T03:32:43.113Z", "modified": "2026-10-03T03:32:44.196Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:32:44.196Z" }, "description_available": false, "entity_type": "uses", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "c257b48a-4e0e-4fa0-98ff-0ecaade409e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--37ff79eb-0270-571d-b35b-3c095bf2745d", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.235Z", "created_at": "2026-10-03T04:03:44.293Z", "modified": "2026-10-03T04:03:45.186Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:03:45.186Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_id": "3238884b-5f6b-4645-b6f2-e233656674e5", "from_name": null, "from_type": "Indicator", "id": "c59a0724-704a-42b0-bf81-c269f318a54d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--2fb6ebc7-7baa-5897-82d6-064328df7bd1", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.906Z", "created_at": "2026-10-03T03:38:40.037Z", "modified": "2026-10-03T03:38:40.957Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:40.957Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1a7a9789-0adc-4b87-b716-133383803962", "from_id": "1a7a9789-0adc-4b87-b716-133383803962", "from_name": null, "from_type": "Indicator", "id": "c66c68dc-674c-411d-8334-4e126d62ceb6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--90527e08-18ab-5f96-84bf-947fce610bbf", "toId": "705d578c-fd3f-4d04-979e-5aecfea019f7", "to_id": "705d578c-fd3f-4d04-979e-5aecfea019f7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.071Z", "created_at": "2026-10-03T03:51:14.349Z", "modified": "2026-10-03T03:51:17.812Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:51:17.812Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_id": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_name": null, "from_type": "Indicator", "id": "c9dcb171-7cbc-40e3-b2a9-768f43231e81", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--6fd8d529-a918-54a5-9cbb-7d7ddef86787", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.261Z", "created_at": "2026-10-03T04:07:12.791Z", "modified": "2026-10-03T04:07:18.330Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:07:18.330Z" }, "description_available": false, "entity_type": "indicates", "fromId": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_id": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "from_name": null, "from_type": "Indicator", "id": "cb0481b1-ab9e-446d-a7df-e163d0e17081", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--e6258d3c-1e4e-5627-948b-c09b0825e238", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.135Z", "created_at": "2026-10-03T03:59:56.578Z", "modified": "2026-10-03T03:59:58.401Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:59:58.401Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_id": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "from_name": null, "from_type": "Indicator", "id": "d0d92660-d8d3-49b2-9d8c-65878e7879aa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--c8fa0079-3390-5a8f-8d66-b68152144e7e", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.133Z", "created_at": "2026-10-03T03:59:39.500Z", "modified": "2026-10-03T03:59:41.052Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:59:41.052Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_id": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "from_name": null, "from_type": "Indicator", "id": "d79a2e28-e864-4245-b817-a325ff34e17e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--0572710b-2bb6-56a8-b0dc-32a3bd7bf80d", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:32:06.089Z", "created_at": "2026-04-21T21:32:48.120Z", "modified": "2026-04-21T21:32:50.599Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T21:32:50.599Z" }, "description_available": false, "entity_type": "based-on", "fromId": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_id": "65a45293-2c6f-43fd-9605-4e90dff074be", "from_name": null, "from_type": "Indicator", "id": "d9556863-8f0d-4670-aa71-03b48af7df7c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--5c1fdf14-5607-5687-96d8-7fdac048a8a1", "toId": "d35492f9-5612-4d12-943f-88772df08166", "to_id": "d35492f9-5612-4d12-943f-88772df08166", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.100Z", "created_at": "2026-10-03T03:54:27.524Z", "modified": "2026-10-03T03:54:28.036Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:54:28.036Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cf28624f-a664-4801-accf-d92c34364102", "from_id": "cf28624f-a664-4801-accf-d92c34364102", "from_name": null, "from_type": "Indicator", "id": "d9572f6d-b5d6-46bc-a99f-01407e987f4c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--6cc28c6f-098e-53c4-9d9d-b0ddf6398bd1", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.883Z", "created_at": "2026-10-03T03:38:03.843Z", "modified": "2026-10-03T03:38:05.983Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:05.983Z" }, "description_available": false, "entity_type": "targets", "fromId": "ea4de683-0cad-4497-a044-65b61045d534", "from_id": "ea4de683-0cad-4497-a044-65b61045d534", "from_name": "T1574.002", "from_type": "AttackPattern", "id": "dae051af-ddd0-4d73-a828-5cb8b5820fe1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--071e95d8-21af-5845-b9e0-c37582425f4d", "toId": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "to_id": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "to_name": "CVE-2025-53770", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.883Z", "created_at": "2026-10-03T03:38:08.457Z", "modified": "2026-10-03T03:38:09.821Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:09.821Z" }, "description_available": false, "entity_type": "targets", "fromId": "ea4de683-0cad-4497-a044-65b61045d534", "from_id": "ea4de683-0cad-4497-a044-65b61045d534", "from_name": "T1574.002", "from_type": "AttackPattern", "id": "e158af79-0858-49a4-b639-61b3c211f405", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--97aa2460-33ad-5190-813c-786e9b422ce7", "toId": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "to_id": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "to_name": "CVE-2025-53771", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.002Z", "created_at": "2026-10-03T03:41:40.127Z", "modified": "2026-10-03T03:41:40.910Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:41:40.910Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a7a9789-0adc-4b87-b716-133383803962", "from_id": "1a7a9789-0adc-4b87-b716-133383803962", "from_name": null, "from_type": "Indicator", "id": "e2a82cb8-009b-433c-bf2c-6efa8c15e332", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--b984ec04-81db-5093-b3b9-4b2423b38754", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.092Z", "created_at": "2026-10-03T03:53:49.447Z", "modified": "2026-10-03T03:53:51.751Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:53:51.751Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cf28624f-a664-4801-accf-d92c34364102", "from_id": "cf28624f-a664-4801-accf-d92c34364102", "from_name": null, "from_type": "Indicator", "id": "e4168e33-0cb4-47e5-a040-d48007e89fe6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--25036a53-fa40-5e3f-bd07-c614e6161d13", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T23:25:16.412Z", "created_at": "2026-04-10T21:02:19.347Z", "modified": "2026-04-10T21:02:20.923Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-10T21:02:20.923Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "e97db758-445a-44a8-9efb-8ea4a9036847", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--068bf912-b619-5ed2-8257-122ed570a937", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.837Z", "created_at": "2026-10-03T03:36:05.125Z", "modified": "2026-10-03T03:36:06.203Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:36:06.203Z" }, "description_available": false, "entity_type": "targets", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "eb14f9bd-14f5-4e96-8684-bb3034fb3838", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--646a0e40-559d-5076-a58b-44871c6a8a22", "toId": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "to_id": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "to_name": "CVE-2025-53771", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.024Z", "created_at": "2026-10-03T03:44:49.545Z", "modified": "2026-10-03T03:44:53.156Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:44:53.156Z" }, "description_available": false, "entity_type": "indicates", "fromId": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_id": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_name": null, "from_type": "Indicator", "id": "ebc71156-295a-4174-85c0-4242405cfe29", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--943a32f2-34c2-5c1c-a031-4ac60df209ae", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.933Z", "created_at": "2026-10-03T03:38:43.395Z", "modified": "2026-10-03T03:38:43.912Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:43.912Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_id": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "from_name": null, "from_type": "Indicator", "id": "ec429548-bdec-443c-98fb-93b0998d59b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--6cef91c3-4d12-5f14-99d3-be9a05b7b268", "toId": "b8f53fa4-5df1-49e8-ab5a-12ecbd0343a9", "to_id": "b8f53fa4-5df1-49e8-ab5a-12ecbd0343a9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.089Z", "created_at": "2026-10-03T03:53:33.795Z", "modified": "2026-10-03T03:53:34.341Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:53:34.341Z" }, "description_available": false, "entity_type": "indicates", "fromId": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_id": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "from_name": null, "from_type": "Indicator", "id": "ee44ee39-b31e-42c2-9600-319892c04b0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--3dc1f595-43dd-58eb-96cf-aa60ed252f9a", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.924Z", "created_at": "2026-10-03T03:38:42.149Z", "modified": "2026-10-03T03:38:42.835Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:42.835Z" }, "description_available": false, "entity_type": "based-on", "fromId": "931a6200-9113-400f-862a-00b2146badd8", "from_id": "931a6200-9113-400f-862a-00b2146badd8", "from_name": null, "from_type": "Indicator", "id": "ee8b638c-44fa-43c3-b317-ad0cdb849a84", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--0a17f83e-5691-5673-aec3-2f1d59c3c216", "toId": "0609e09b-3a11-42eb-868a-4a58c1088d9c", "to_id": "0609e09b-3a11-42eb-868a-4a58c1088d9c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.103Z", "created_at": "2026-10-03T03:55:04.381Z", "modified": "2026-10-03T03:55:07.238Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:55:07.238Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_id": "eaaf924b-dda4-4f4f-9005-67309f56f272", "from_name": null, "from_type": "Indicator", "id": "f18d07c9-aef1-4ea4-aead-ab0dcbcd69c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--dabe903b-f6bc-511c-a598-ecd0668299c4", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.979Z", "created_at": "2026-10-03T03:39:24.162Z", "modified": "2026-10-03T03:39:26.258Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:39:26.258Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_id": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "from_name": null, "from_type": "Indicator", "id": "f3c6972a-d16d-4cdf-be2b-4c2d10341178", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--747ba71a-dcab-54be-bd3f-21f4c5cd5c77", "toId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "to_name": "Longlegs", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.239Z", "created_at": "2026-10-03T04:04:01.489Z", "modified": "2026-10-03T04:04:03.385Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:04:03.385Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_id": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "from_name": null, "from_type": "Indicator", "id": "f9736941-892e-4125-9505-ff112ac5c0ac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--dbe62cb0-2ee7-539c-b152-7ae5e3aa1dfb", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:13.003Z", "created_at": "2026-10-03T03:41:41.983Z", "modified": "2026-10-03T03:41:42.976Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:41:42.976Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a7a9789-0adc-4b87-b716-133383803962", "from_id": "1a7a9789-0adc-4b87-b716-133383803962", "from_name": null, "from_type": "Indicator", "id": "fddf0ca9-b207-469e-8789-cf464cd35a53", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--c61562fc-c0fd-50df-b2eb-a56064616f90", "toId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "to_name": "WarLock", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.913Z", "created_at": "2026-10-03T03:38:41.822Z", "modified": "2026-10-03T03:38:42.484Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:38:42.484Z" }, "description_available": false, "entity_type": "based-on", "fromId": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_id": "537f0804-d40f-48d7-b59e-d3342d245cb5", "from_name": null, "from_type": "Indicator", "id": "fe79f65a-0f32-4059-a3a7-7dafb9fb09e2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--8676d4b8-99c3-5735-b8ff-44886da4b5d7", "toId": "e82fda87-a856-4723-81a6-40eeae51ae99", "to_id": "e82fda87-a856-4723-81a6-40eeae51ae99", "to_name": null, "to_type": "StixFile" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "80961850786d6531f075b8a6f9a756ad", "description_available": false, "object_id": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "object_ids": [ "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "b0eb706a-b19f-498a-b468-d42a62ae81ba" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4bc5f3da-02c8-490c-8ade-59b67e55d5de", "valid_from": "2026-02-05T20:21:26.000Z", "valid_until": "2026-11-23T07:31:10.557Z", "validity_status": "active", "value": "80961850786d6531f075b8a6f9a756ad" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b0eb706a-b19f-498a-b468-d42a62ae81ba", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "80961850786d6531f075b8a6f9a756ad" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "md5", "valid_from": "2026-02-05T20:21:26.000Z", "valid_until": "2026-11-23T07:31:10.557Z", "validity_status": "active", "value": "80961850786d6531f075b8a6f9a756ad" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b0b912a3fd1c05d72080848ec4c92880004021a1", "description_available": false, "object_id": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "object_ids": [ "19eaba70-a8ba-4ff6-8f34-7ba4b521a1e9", "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6d5a9c30-aa6d-4bb6-aa09-9ba09af7bf36", "valid_from": "2026-02-05T20:21:26.000Z", "valid_until": "2026-11-23T07:31:10.557Z", "validity_status": "active", "value": "b0b912a3fd1c05d72080848ec4c92880004021a1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "19eaba70-a8ba-4ff6-8f34-7ba4b521a1e9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b0b912a3fd1c05d72080848ec4c92880004021a1" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha1", "valid_from": "2026-02-05T20:21:26.000Z", "valid_until": "2026-11-23T07:31:10.557Z", "validity_status": "active", "value": "b0b912a3fd1c05d72080848ec4c92880004021a1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2c", "description_available": false, "object_id": "1a7a9789-0adc-4b87-b716-133383803962", "object_ids": [ "1a7a9789-0adc-4b87-b716-133383803962", "705d578c-fd3f-4d04-979e-5aecfea019f7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1a7a9789-0adc-4b87-b716-133383803962", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "705d578c-fd3f-4d04-979e-5aecfea019f7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2c" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55", "description_available": false, "object_id": "42725fae-afa8-41bf-a870-ec24ff40e37b", "object_ids": [ "42725fae-afa8-41bf-a870-ec24ff40e37b", "c62e6a69-9e60-40c6-8682-aa59419f569c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "42725fae-afa8-41bf-a870-ec24ff40e37b", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c62e6a69-9e60-40c6-8682-aa59419f569c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60", "description_available": false, "object_id": "537f0804-d40f-48d7-b59e-d3342d245cb5", "object_ids": [ "537f0804-d40f-48d7-b59e-d3342d245cb5", "e82fda87-a856-4723-81a6-40eeae51ae99" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "537f0804-d40f-48d7-b59e-d3342d245cb5", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e82fda87-a856-4723-81a6-40eeae51ae99", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261", "description_available": false, "object_id": "65a45293-2c6f-43fd-9605-4e90dff074be", "object_ids": [ "65a45293-2c6f-43fd-9605-4e90dff074be", "d35492f9-5612-4d12-943f-88772df08166" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "65a45293-2c6f-43fd-9605-4e90dff074be", "valid_from": "2026-02-05T20:21:26.000Z", "valid_until": "2026-11-23T07:31:10.557Z", "validity_status": "active", "value": "206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d35492f9-5612-4d12-943f-88772df08166", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-02-05T20:21:26.000Z", "valid_until": "2026-11-23T07:31:10.557Z", "validity_status": "active", "value": "206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0", "description_available": false, "object_id": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "object_ids": [ "37fc5e02-0c8b-49f8-a220-ad5ed23f4edb", "525148b4-bea3-48b1-ac2a-625bb4fb2ed5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "525148b4-bea3-48b1-ac2a-625bb4fb2ed5", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "37fc5e02-0c8b-49f8-a220-ad5ed23f4edb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e", "description_available": false, "object_id": "931a6200-9113-400f-862a-00b2146badd8", "object_ids": [ "0609e09b-3a11-42eb-868a-4a58c1088d9c", "931a6200-9113-400f-862a-00b2146badd8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "931a6200-9113-400f-862a-00b2146badd8", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0609e09b-3a11-42eb-868a-4a58c1088d9c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad", "description_available": false, "object_id": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "object_ids": [ "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "8dbdb4bf-89e2-4edb-8603-1cbefecb0f2a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "83ec2833-a5a7-458f-ab0a-bfceb7cd422e", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8dbdb4bf-89e2-4edb-8603-1cbefecb0f2a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36ea", "description_available": false, "object_id": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "object_ids": [ "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "b8f53fa4-5df1-49e8-ab5a-12ecbd0343a9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4f3d4e44-d526-43b4-b421-faf010f8ad3a", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36ea" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b8f53fa4-5df1-49e8-ab5a-12ecbd0343a9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36ea" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36ea" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125f", "description_available": false, "object_id": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "object_ids": [ "378c1f0d-6075-4444-9105-c34dbb7f0ad0", "664b44b5-e6f0-4a9a-b0af-fb656a64493c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "664b44b5-e6f0-4a9a-b0af-fb656a64493c", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "378c1f0d-6075-4444-9105-c34dbb7f0ad0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125f" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9", "description_available": false, "object_id": "cf28624f-a664-4801-accf-d92c34364102", "object_ids": [ "73c99221-d365-4034-ad0e-072f05837c91", "cf28624f-a664-4801-accf-d92c34364102" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "cf28624f-a664-4801-accf-d92c34364102", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "73c99221-d365-4034-ad0e-072f05837c91", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7", "description_available": false, "object_id": "eaaf924b-dda4-4f4f-9005-67309f56f272", "object_ids": [ "8769ce71-6e98-40d5-b46b-d0a11e9904d0", "eaaf924b-dda4-4f4f-9005-67309f56f272" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "eaaf924b-dda4-4f4f-9005-67309f56f272", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "8769ce71-6e98-40d5-b46b-d0a11e9904d0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192", "description_available": false, "object_id": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "object_ids": [ "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "da35ab46-3781-4d05-add9-d933961580f4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "815e93d6-5f0b-45ea-82cf-3f7d064f63ff", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "da35ab46-3781-4d05-add9-d933961580f4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295", "description_available": false, "object_id": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "object_ids": [ "11e839e3-249d-4f53-a46e-58c8ac1911b2", "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ca5e7e76-0369-4980-b2e1-d3d3244b0b2b", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "11e839e3-249d-4f53-a46e-58c8ac1911b2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e", "description_available": false, "object_id": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "object_ids": [ "09216b18-95cf-459b-a0cb-3e230f14d370", "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8b27d2fe-0da9-4ec7-ad23-9c4aa220bc07", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "09216b18-95cf-459b-a0cb-3e230f14d370", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20", "description_available": false, "object_id": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "object_ids": [ "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "ce2686eb-ef3f-4546-b058-8fb9839c757c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "664eeedf-c6ba-4ec1-8af2-ec08a74d295f", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ce2686eb-ef3f-4546-b058-8fb9839c757c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1", "description_available": false, "object_id": "3238884b-5f6b-4645-b6f2-e233656674e5", "object_ids": [ "3238884b-5f6b-4645-b6f2-e233656674e5", "b9896c98-049c-46ab-b91d-322ed189c466" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3238884b-5f6b-4645-b6f2-e233656674e5", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b9896c98-049c-46ab-b91d-322ed189c466", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed", "description_available": false, "object_id": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "object_ids": [ "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "7ec09d08-ad13-4b7f-80c9-77a7fcad3c90" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2ad8abfe-278f-4df4-b0e4-a02aa0df8853", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "7ec09d08-ad13-4b7f-80c9-77a7fcad3c90", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf", "description_available": false, "object_id": "d80b334f-3e63-403a-9737-f6adceb87e9a", "object_ids": [ "d80b334f-3e63-403a-9737-f6adceb87e9a", "e11de47f-11df-4a0e-bf8a-4931e58fc8b5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d80b334f-3e63-403a-9737-f6adceb87e9a", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e11de47f-11df-4a0e-bf8a-4931e58fc8b5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984", "description_available": false, "object_id": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "object_ids": [ "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "d539be1e-e4bd-4059-95e1-5182c4824dc2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "19867fdf-12c7-4a8c-9220-c83f2eceba8a", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d539be1e-e4bd-4059-95e1-5182c4824dc2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984" } ], "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "type": "sha256", "valid_from": "2026-10-01T15:37:44.000Z", "valid_until": "2027-07-19T02:47:28.557Z", "validity_status": "active", "value": "fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984" } ], "mentioned": [ { "confidence": 50, "evidence_id": "ea4de683-0cad-4497-a044-65b61045d534", "name": "T1574.002", "role": "mentionné", "type": "Attack-Pattern" }, { "confidence": 50, "evidence_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "name": "WarLock", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "aa66b7a4-2d73-429d-adba-bd751a684724", "name": "CVE-2025-1055", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "c1db4316-04b9-4c23-8d51-f49cf723b4be", "name": "CVE-2025-49704", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "7311a7a0-c89a-4354-a1d6-757647f06178", "name": "CVE-2025-49706", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "fc292f7a-7764-4828-8bbd-d04bbc0217c6", "name": "CVE-2025-53770", "role": "mentionné", "type": "Vulnerability" }, { "confidence": 80, "evidence_id": "901dbef0-53a5-49ae-8d1a-988848c46e5b", "name": "CVE-2025-53771", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T23:25:16.336Z", "created_at": "2026-04-10T21:04:45.718Z", "modified": "2026-04-10T21:04:45.988Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-10T21:04:45.988Z" }, "description_available": false, "entity_type": "uses", "fromId": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "from_name": "WarLock", "from_type": "Malware", "id": "86d9b4ae-33ca-4410-b63b-db948e64e85e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--864fd28d-bec4-5b3f-a3ef-0fc6ebca8e03", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "86d9b4ae-33ca-4410-b63b-db948e64e85e", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "86d9b4ae-33ca-4410-b63b-db948e64e85e" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "name": "WarLock", "type": "Malware" } ] } ], "via_entity": { "id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "name": "WarLock", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:12.811Z", "created_at": "2026-10-03T03:33:58.901Z", "modified": "2026-10-03T03:33:59.545Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T03:33:59.545Z" }, "description_available": false, "entity_type": "uses", "fromId": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "from_name": "Longlegs", "from_type": "IntrusionSet", "id": "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "standard_id": "relationship--6ec506ca-825f-535b-a168-f7a88814978c", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "name": "Longlegs", "type": "IntrusionSet" } ] } ], "via_entity": { "id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "name": "Longlegs", "type": "IntrusionSet" } } ], "direct_techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "16acb7f5-f66c-4986-ad33-33de86ff71b0", "16f463a8-3780-4b1a-b21a-483aa6d622ef", "214459fe-7304-4797-a277-540fb8e5d246", "252d7cea-407e-40ad-91f3-88d1761b168c", "2cd5e630-50b4-49c1-80df-ab466fedcef8", "2fe6528f-28f0-4cdc-9546-f151ad311b38", "35c0f761-4481-4634-be0c-1331e6cfb5c9", "36be355a-675b-4774-bc34-3460fc646e10", "3e047142-dcee-4fb5-8244-d83725d07be3", "3e298610-1da1-4b82-9618-37f4007bdf30", "3eef3934-e3a6-46d3-ba5e-61db19a5690d", "547f2a50-22d6-4008-8bdd-f3ba6505640f", "5999d507-9667-4a01-9dfe-1690edf52594", "5de2f660-9bca-437b-81a5-00ef515b6770", "86d9b4ae-33ca-4410-b63b-db948e64e85e", "95864d48-fb0a-4325-9f48-b3ebf59ede35", "9ab64762-ce5b-47f8-9004-d8cd91ddb0a3", "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70", "b3a6aefe-0519-4670-b9dd-9331bca9dede", "b8451d92-0980-49e9-9cbb-670db94d6af9", "b95f97d9-0f84-4a0c-abe6-3b2747e528b5", "bac55aa4-0382-4ad7-aa1d-b3aa78b9c896", "c59a0724-704a-42b0-bf81-c269f318a54d", "d79a2e28-e864-4245-b817-a325ff34e17e", "d9572f6d-b5d6-46bc-a99f-01407e987f4c", "dae051af-ddd0-4d73-a828-5cb8b5820fe1", "e158af79-0858-49a4-b639-61b3c211f405", "ea4de683-0cad-4497-a044-65b61045d534", "ee44ee39-b31e-42c2-9600-319892c04b0c" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "16acb7f5-f66c-4986-ad33-33de86ff71b0", "16f463a8-3780-4b1a-b21a-483aa6d622ef", "214459fe-7304-4797-a277-540fb8e5d246", "252d7cea-407e-40ad-91f3-88d1761b168c", "2cd5e630-50b4-49c1-80df-ab466fedcef8", "2fe6528f-28f0-4cdc-9546-f151ad311b38", "35c0f761-4481-4634-be0c-1331e6cfb5c9", "36be355a-675b-4774-bc34-3460fc646e10", "3e047142-dcee-4fb5-8244-d83725d07be3", "3e298610-1da1-4b82-9618-37f4007bdf30", "3eef3934-e3a6-46d3-ba5e-61db19a5690d", "547f2a50-22d6-4008-8bdd-f3ba6505640f", "5999d507-9667-4a01-9dfe-1690edf52594", "5de2f660-9bca-437b-81a5-00ef515b6770", "86d9b4ae-33ca-4410-b63b-db948e64e85e", "95864d48-fb0a-4325-9f48-b3ebf59ede35", "9ab64762-ce5b-47f8-9004-d8cd91ddb0a3", "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70", "b3a6aefe-0519-4670-b9dd-9331bca9dede", "b8451d92-0980-49e9-9cbb-670db94d6af9", "b95f97d9-0f84-4a0c-abe6-3b2747e528b5", "bac55aa4-0382-4ad7-aa1d-b3aa78b9c896", "c59a0724-704a-42b0-bf81-c269f318a54d", "d79a2e28-e864-4245-b817-a325ff34e17e", "d9572f6d-b5d6-46bc-a99f-01407e987f4c", "dae051af-ddd0-4d73-a828-5cb8b5820fe1", "e158af79-0858-49a4-b639-61b3c211f405", "ee44ee39-b31e-42c2-9600-319892c04b0c" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "name": "WarLock", "type": "Malware" }, { "id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "name": "Longlegs", "type": "IntrusionSet" } ] } ], "official_catalog": { "complete": true, "fetched_at": "2026-10-08T07:58:58Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T15:37:42.968Z", "created_at": "2026-10-03T04:08:26.725Z", "modified": "2026-10-03T04:08:29.377Z", "published": "2026-10-01T15:37:42.968Z", "updated_at": "2026-10-03T04:08:29.377Z" }, "description_available": true, "id": "233aa908-366d-4dc2-855b-a5049871edec", "is_inferred": false, "labels": [ "byovd", "critical infrastructure", "cve-2025-1055", "cve-2025-49704", "cve-2025-49706", "cve-2025-53770", "cve-2025-53771", "longlegs", "sharepoint exploitation", "storm-2603", "telecommunications", "toolshell", "warlock", "water utility" ], "lang": "en", "name": "Warlock Ransomware Attackers Hit Water and Telecom Operators", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-10-01T15:37:42.968Z", "references": [ { "external_id": null, "id": "ed761011-bf63-429c-b4ba-fb62a06792c3", "source_name": "alien-vault", "url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure" }, { "external_id": "6abe7e463c092196777a7816", "id": "a5ffb7fc-1384-43ee-b559-e089b710f1ea", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6abe7e463c092196777a7816" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure" }, "targets": [ { "confidence": 50, "evidence_id": "773c0526-5202-484f-86f7-c91950a06915", "name": "Education", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "92966325-a3c5-4211-9676-968fa236c567", "name": "Energy", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "e97db758-445a-44a8-9efb-8ea4a9036847", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "89dc71d8-6654-4545-a887-c3dea2892dd6", "name": "Telecommunications", "role": "cible déclarée (relation targets)", "type": "Sector" } ], "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "16acb7f5-f66c-4986-ad33-33de86ff71b0", "16f463a8-3780-4b1a-b21a-483aa6d622ef", "214459fe-7304-4797-a277-540fb8e5d246", "252d7cea-407e-40ad-91f3-88d1761b168c", "2cd5e630-50b4-49c1-80df-ab466fedcef8", "2fe6528f-28f0-4cdc-9546-f151ad311b38", "35c0f761-4481-4634-be0c-1331e6cfb5c9", "36be355a-675b-4774-bc34-3460fc646e10", "3e047142-dcee-4fb5-8244-d83725d07be3", "3e298610-1da1-4b82-9618-37f4007bdf30", "3eef3934-e3a6-46d3-ba5e-61db19a5690d", "547f2a50-22d6-4008-8bdd-f3ba6505640f", "5999d507-9667-4a01-9dfe-1690edf52594", "5de2f660-9bca-437b-81a5-00ef515b6770", "86d9b4ae-33ca-4410-b63b-db948e64e85e", "95864d48-fb0a-4325-9f48-b3ebf59ede35", "9ab64762-ce5b-47f8-9004-d8cd91ddb0a3", "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70", "b3a6aefe-0519-4670-b9dd-9331bca9dede", "b8451d92-0980-49e9-9cbb-670db94d6af9", "b95f97d9-0f84-4a0c-abe6-3b2747e528b5", "bac55aa4-0382-4ad7-aa1d-b3aa78b9c896", "c59a0724-704a-42b0-bf81-c269f318a54d", "d79a2e28-e864-4245-b817-a325ff34e17e", "d9572f6d-b5d6-46bc-a99f-01407e987f4c", "dae051af-ddd0-4d73-a828-5cb8b5820fe1", "e158af79-0858-49a4-b639-61b3c211f405", "ea4de683-0cad-4497-a044-65b61045d534", "ee44ee39-b31e-42c2-9600-319892c04b0c" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "16acb7f5-f66c-4986-ad33-33de86ff71b0", "16f463a8-3780-4b1a-b21a-483aa6d622ef", "214459fe-7304-4797-a277-540fb8e5d246", "252d7cea-407e-40ad-91f3-88d1761b168c", "2cd5e630-50b4-49c1-80df-ab466fedcef8", "2fe6528f-28f0-4cdc-9546-f151ad311b38", "35c0f761-4481-4634-be0c-1331e6cfb5c9", "36be355a-675b-4774-bc34-3460fc646e10", "3e047142-dcee-4fb5-8244-d83725d07be3", "3e298610-1da1-4b82-9618-37f4007bdf30", "3eef3934-e3a6-46d3-ba5e-61db19a5690d", "547f2a50-22d6-4008-8bdd-f3ba6505640f", "5999d507-9667-4a01-9dfe-1690edf52594", "5de2f660-9bca-437b-81a5-00ef515b6770", "86d9b4ae-33ca-4410-b63b-db948e64e85e", "95864d48-fb0a-4325-9f48-b3ebf59ede35", "9ab64762-ce5b-47f8-9004-d8cd91ddb0a3", "a8c4e070-3bb1-4ea8-8ad2-6c2bf4256c70", "b3a6aefe-0519-4670-b9dd-9331bca9dede", "b8451d92-0980-49e9-9cbb-670db94d6af9", "b95f97d9-0f84-4a0c-abe6-3b2747e528b5", "bac55aa4-0382-4ad7-aa1d-b3aa78b9c896", "c59a0724-704a-42b0-bf81-c269f318a54d", "d79a2e28-e864-4245-b817-a325ff34e17e", "d9572f6d-b5d6-46bc-a99f-01407e987f4c", "dae051af-ddd0-4d73-a828-5cb8b5820fe1", "e158af79-0858-49a4-b639-61b3c211f405", "ee44ee39-b31e-42c2-9600-319892c04b0c" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "226ab729-6d26-4301-8d4b-712ecfc82ca1", "name": "WarLock", "type": "Malware" }, { "id": "f725cfd0-9d36-47f3-8f08-e6d76fa92ff8", "name": "Longlegs", "type": "IntrusionSet" } ] } ], "vulnerabilities": [ "CVE-2025-1055", "CVE-2025-49704", "CVE-2025-49706", "CVE-2025-53770", "CVE-2025-53771" ] }, "report_id": "233aa908-366d-4dc2-855b-a5049871edec", "schema_version": 1, "selected_date": "2026-10-01", "source_url": "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure" }