{
  "intelligence": {
    "actors": [],
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 0,
      "deduplicated_iocs": 5,
      "direct_entities": 14,
      "direct_relationships": 13,
      "invalid_iocs": 0,
      "iocs": 5,
      "mentioned": 4,
      "mitre_associated": 0,
      "mitre_direct": 0,
      "targets": 0,
      "techniques": 0,
      "unsupported_indicators": 0,
      "vulnerabilities": 3
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 0,
      "excluded_graph_objects": 0,
      "graph_complete": true,
      "graph_objects": 14,
      "graph_relationships": 13,
      "mitre_context_complete": true,
      "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
      "status_as_of": "2026-10-08T07:52:01+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-10-03T03:22:23.534Z",
          "updated_at": "2026-10-03T03:22:26.507Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "35337a91-33d9-4551-9099-54ebc4e3e2e0",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "file--8bfd8340-4a20-5d9a-834b-0abc5a1b0ebc",
        "type": "StixFile"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2026-07-17T20:17:28.490Z",
          "created_at": "2026-08-08T19:38:44.121Z",
          "modified": "2026-10-08T01:21:25.931Z",
          "updated_at": "2026-10-08T01:21:25.931Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "4f275781-30af-4e1e-affa-090a4b6c7f16",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2026-63030",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2026-63030",
            "id": "c7be47ad-ebb4-4e14-b818-2332827f930b",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030"
          },
          {
            "external_id": null,
            "id": "0d7ad153-c561-452b-999e-777de3ca0bea",
            "source_name": "contact@wpscan.com",
            "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q"
          },
          {
            "external_id": null,
            "id": "f8c7c6c5-4157-48d8-bfec-aff07a218bd5",
            "source_name": "contact@wpscan.com",
            "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "vulnerability--5e87ff47-2c9a-5582-ab9d-8989913680c1",
        "type": "Vulnerability"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.777Z",
          "created_at": "2026-10-03T03:22:54.708Z",
          "modified": "2026-10-03T08:05:19.895Z",
          "updated_at": "2026-10-03T08:05:19.895Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "4f9b8dfd-584d-428e-8561-8cf56064b60a",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "indicator--ffb3fe6d-860e-5645-8106-46e12fca3c19",
        "type": "Indicator"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2026-07-17T20:17:27.790Z",
          "created_at": "2026-08-08T19:38:17.716Z",
          "modified": "2026-10-08T01:21:23.457Z",
          "updated_at": "2026-10-08T01:21:23.457Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "802136a0-c009-4e53-a497-45699929f503",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2026-60137",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2026-60137",
            "id": "eeab7033-2a58-446b-a152-230cec9bf6dc",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137"
          },
          {
            "external_id": null,
            "id": "af95d248-7cdd-46b8-b899-0b69c02f24c8",
            "source_name": "contact@wpscan.com",
            "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf"
          },
          {
            "external_id": null,
            "id": "f8c7c6c5-4157-48d8-bfec-aff07a218bd5",
            "source_name": "contact@wpscan.com",
            "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "vulnerability--d73a1121-1a53-590a-aedf-551a012d3a8b",
        "type": "Vulnerability"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "IPv4-Addr",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.765Z",
          "created_at": "2026-10-03T03:22:31.284Z",
          "modified": "2026-10-03T08:05:08.919Z",
          "updated_at": "2026-10-03T08:05:08.919Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "8c40de06-fcaa-432b-b140-733807f9dddb",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "indicator--7202f986-2cb9-58d6-b517-78235be166a7",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.771Z",
          "created_at": "2026-10-03T03:22:41.806Z",
          "modified": "2026-10-03T08:05:13.909Z",
          "updated_at": "2026-10-03T08:05:13.909Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "90138976-4154-415b-9c1c-fb802e6e9e09",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "indicator--040c8f72-4bce-5f40-aa5c-19bbfcf7ff7e",
        "type": "Indicator"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2026-09-27T00:00:00.000Z",
          "created_at": "2026-09-27T20:47:14.970Z",
          "modified": "2026-10-01T08:06:31.181Z",
          "updated_at": "2026-10-01T08:06:31.181Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2026-88771",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2026-88771",
            "id": "06c9dd90-7190-465a-b4e4-1dfde14bd056",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88771"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "vulnerability--ffd248e0-8f5c-5fa9-8a08-bf788da49f49",
        "type": "Vulnerability"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.768Z",
          "created_at": "2026-10-03T03:22:41.643Z",
          "modified": "2026-10-03T08:05:13.244Z",
          "updated_at": "2026-10-03T08:05:13.244Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "indicator--3aa1691f-d21a-532e-b8d5-230adb450bac",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-10-03T03:22:29.278Z",
          "updated_at": "2026-10-03T03:22:32.445Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "dd0e0801-f460-4a91-992f-f1558697c94c",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "file--2e650057-c4d6-5117-a00b-582140c8f613",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.774Z",
          "created_at": "2026-10-03T03:22:43.116Z",
          "modified": "2026-10-03T08:05:18.314Z",
          "updated_at": "2026-10-03T08:05:18.314Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "dde0696a-3f20-4865-8cd7-88a480b9eb10",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "indicator--1f2594ba-e589-5a86-acad-817f400e922d",
        "type": "Indicator"
      },
      {
        "__typename": "Malware",
        "aliases": [],
        "attributes": {
          "is_family": false
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.758Z",
          "created_at": "2026-10-03T03:22:13.339Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-10-03T03:22:14.406Z",
          "updated_at": "2026-10-03T03:22:14.406Z"
        },
        "description_available": false,
        "entity_type": "Malware",
        "id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "TIKTOUK",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "malware--c0d46e78-e078-54f7-b019-16dbd736f4ae",
        "type": "Malware"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-10-03T03:22:31.062Z",
          "updated_at": "2026-10-03T03:22:35.150Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "e146d02a-4424-45ec-aa7a-ac909c9949b2",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "file--71d4b663-929b-52f5-8ee0-b6e4d4e8c116",
        "type": "StixFile"
      },
      {
        "__typename": "IPv4Addr",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-10-03T03:22:23.684Z",
          "updated_at": "2026-10-03T08:05:07.568Z"
        },
        "description_available": false,
        "entity_type": "IPv4-Addr",
        "id": "ea5341e5-3f20-4478-81fa-ba9e24f6bd77",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "ipv4-addr--02284c4e-39f1-5627-b601-2ea93cdc74a5",
        "type": "IPv4Addr"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-10-03T03:22:21.840Z",
          "updated_at": "2026-10-03T03:22:25.700Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "f2166b03-7941-4b25-b904-ea8805c0214e",
        "is_inferred": false,
        "labels": [
          "aws credentials",
          "configuration exposure",
          "credential theft",
          "cve-2026-60137",
          "cve-2026-63030",
          "javascript scanning",
          "rest api probing",
          "smtp plugin decryption",
          "tiktouk",
          "wordpress"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "file--967d4789-86a7-50a7-957f-0b0aa9bdad35",
        "type": "StixFile"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.763Z",
          "created_at": "2026-10-03T03:23:24.526Z",
          "modified": "2026-10-03T03:23:27.170Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:27.170Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "from_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "from_name": "TIKTOUK",
        "from_type": "Malware",
        "id": "0cdc4a68-97c1-4213-9c68-26b9dde9b81a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--85c534f8-9b28-5fec-8d30-3ed09cdd2455",
        "toId": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179",
        "to_id": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179",
        "to_name": "CVE-2026-88771",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.769Z",
          "created_at": "2026-10-03T03:23:24.417Z",
          "modified": "2026-10-03T03:23:27.169Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:27.169Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9",
        "from_id": "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "631a0317-c8cf-43d1-9a1b-55b0b228ef6d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--ef1d02e6-4424-5012-95dc-1b2f8584a105",
        "toId": "35337a91-33d9-4551-9099-54ebc4e3e2e0",
        "to_id": "35337a91-33d9-4551-9099-54ebc4e3e2e0",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.776Z",
          "created_at": "2026-10-03T03:23:30.808Z",
          "modified": "2026-10-03T03:23:40.091Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:40.091Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "dde0696a-3f20-4865-8cd7-88a480b9eb10",
        "from_id": "dde0696a-3f20-4865-8cd7-88a480b9eb10",
        "from_name": null,
        "from_type": "Indicator",
        "id": "64f728b8-3f12-412a-a676-e98914f9ff5d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--91939331-af50-50ad-bbb3-63da6c8899ab",
        "toId": "dd0e0801-f460-4a91-992f-f1558697c94c",
        "to_id": "dd0e0801-f460-4a91-992f-f1558697c94c",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.773Z",
          "created_at": "2026-10-03T03:23:26.209Z",
          "modified": "2026-10-03T03:23:30.202Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:30.202Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "90138976-4154-415b-9c1c-fb802e6e9e09",
        "from_id": "90138976-4154-415b-9c1c-fb802e6e9e09",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7455d2fd-0e92-4939-b247-4a8223462b43",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--eb226569-fdc6-5541-bece-f0f203cd822e",
        "toId": "f2166b03-7941-4b25-b904-ea8805c0214e",
        "to_id": "f2166b03-7941-4b25-b904-ea8805c0214e",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.780Z",
          "created_at": "2026-10-03T03:23:45.496Z",
          "modified": "2026-10-03T03:23:50.208Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:50.208Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "90138976-4154-415b-9c1c-fb802e6e9e09",
        "from_id": "90138976-4154-415b-9c1c-fb802e6e9e09",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7ecc9aaf-32cc-4296-9839-35ded58da0c4",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--f07028d6-f4e6-5d6f-a7fc-9a0f68be6a6d",
        "toId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_name": "TIKTOUK",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.780Z",
          "created_at": "2026-10-03T03:23:45.484Z",
          "modified": "2026-10-03T03:23:50.207Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:50.207Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9",
        "from_id": "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "806fbf11-eeba-4ef2-8de1-969a9db717fa",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--d47a7129-b9f3-51da-9f26-2e7aacf415f5",
        "toId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_name": "TIKTOUK",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.779Z",
          "created_at": "2026-10-03T03:23:31.910Z",
          "modified": "2026-10-03T03:23:40.966Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:40.966Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "8c40de06-fcaa-432b-b140-733807f9dddb",
        "from_id": "8c40de06-fcaa-432b-b140-733807f9dddb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "8b010c93-2f61-4a8f-bb01-7852c8030340",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--72a196d8-54fc-504d-be13-82a3ff5b1946",
        "toId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_name": "TIKTOUK",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.762Z",
          "created_at": "2026-10-03T03:23:16.690Z",
          "modified": "2026-10-03T03:23:19.163Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:19.163Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "from_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "from_name": "TIKTOUK",
        "from_type": "Malware",
        "id": "9350cb2d-f5ad-4ffd-ac29-e539f1b0ab99",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--94d4a476-e6cc-5e3a-aacd-1f77b40a42c2",
        "toId": "802136a0-c009-4e53-a497-45699929f503",
        "to_id": "802136a0-c009-4e53-a497-45699929f503",
        "to_name": "CVE-2026-60137",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.781Z",
          "created_at": "2026-10-03T03:23:45.556Z",
          "modified": "2026-10-03T03:23:50.209Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:50.209Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "dde0696a-3f20-4865-8cd7-88a480b9eb10",
        "from_id": "dde0696a-3f20-4865-8cd7-88a480b9eb10",
        "from_name": null,
        "from_type": "Indicator",
        "id": "983b8a4a-7fa8-405f-8aec-fb58c31fe2cf",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--f6e2af47-1bd5-5d9e-b907-23246881a2ed",
        "toId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_name": "TIKTOUK",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.761Z",
          "created_at": "2026-10-03T03:22:56.841Z",
          "modified": "2026-10-03T03:23:07.312Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:07.312Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "from_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "from_name": "TIKTOUK",
        "from_type": "Malware",
        "id": "d791d35a-db3b-4568-86fc-d7e42f5fe1ad",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--0df8590a-97b1-5c94-aaa8-98c0a6ee38f9",
        "toId": "4f275781-30af-4e1e-affa-090a4b6c7f16",
        "to_id": "4f275781-30af-4e1e-affa-090a4b6c7f16",
        "to_name": "CVE-2026-63030",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.781Z",
          "created_at": "2026-10-03T03:23:53.780Z",
          "modified": "2026-10-03T03:23:57.746Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:57.746Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "4f9b8dfd-584d-428e-8561-8cf56064b60a",
        "from_id": "4f9b8dfd-584d-428e-8561-8cf56064b60a",
        "from_name": null,
        "from_type": "Indicator",
        "id": "efaa27cb-dff8-4314-b3d7-e88d7b8f56eb",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--239324a0-5e7b-5af2-b22f-95e96591f279",
        "toId": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "to_name": "TIKTOUK",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.767Z",
          "created_at": "2026-10-03T03:23:18.530Z",
          "modified": "2026-10-03T03:23:21.066Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:21.066Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "8c40de06-fcaa-432b-b140-733807f9dddb",
        "from_id": "8c40de06-fcaa-432b-b140-733807f9dddb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f379049f-9eaa-4a60-912e-ee5f402a65f0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--335d061d-a290-568d-98b8-263ef8026081",
        "toId": "ea5341e5-3f20-4478-81fa-ba9e24f6bd77",
        "to_id": "ea5341e5-3f20-4478-81fa-ba9e24f6bd77",
        "to_name": null,
        "to_type": "IPv4Addr"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-10-03T00:52:04.778Z",
          "created_at": "2026-10-03T03:23:30.891Z",
          "modified": "2026-10-03T03:23:40.087Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-10-03T03:23:40.087Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "4f9b8dfd-584d-428e-8561-8cf56064b60a",
        "from_id": "4f9b8dfd-584d-428e-8561-8cf56064b60a",
        "from_name": null,
        "from_type": "Indicator",
        "id": "fbf5041f-b220-443e-a22e-45fa969e70f4",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "standard_id": "relationship--5250e686-d189-5ddb-a8f2-04e90bcc9473",
        "toId": "e146d02a-4424-45ec-aa7a-ac909c9949b2",
        "to_id": "e146d02a-4424-45ec-aa7a-ac909c9949b2",
        "to_name": null,
        "to_type": "StixFile"
      }
    ],
    "iocs": [
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "193[.]32[.]162[.]134",
        "description_available": false,
        "object_id": "8c40de06-fcaa-432b-b140-733807f9dddb",
        "object_ids": [
          "8c40de06-fcaa-432b-b140-733807f9dddb",
          "ea5341e5-3f20-4478-81fa-ba9e24f6bd77"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "8c40de06-fcaa-432b-b140-733807f9dddb",
            "valid_from": "2026-10-01T21:20:52.000Z",
            "valid_until": "2026-10-22T02:55:31.434Z",
            "validity_status": "active",
            "value": "193.32.162.134"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet IPv4Addr explicitement associé au rapport source.",
            "object_id": "ea5341e5-3f20-4478-81fa-ba9e24f6bd77",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "193.32.162.134"
          }
        ],
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "type": "ipv4",
        "valid_from": "2026-10-01T21:20:52.000Z",
        "valid_until": "2026-10-22T02:55:31.434Z",
        "validity_status": "active",
        "value": "193.32.162.134"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "9903f4576980ff7cfd560ca57c665a4b59b3c30d",
        "description_available": false,
        "object_id": "4f9b8dfd-584d-428e-8561-8cf56064b60a",
        "object_ids": [
          "4f9b8dfd-584d-428e-8561-8cf56064b60a",
          "e146d02a-4424-45ec-aa7a-ac909c9949b2"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "4f9b8dfd-584d-428e-8561-8cf56064b60a",
            "valid_from": "2026-10-01T21:20:52.000Z",
            "valid_until": "2027-07-19T08:30:36.557Z",
            "validity_status": "active",
            "value": "9903f4576980ff7cfd560ca57c665a4b59b3c30d"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "e146d02a-4424-45ec-aa7a-ac909c9949b2",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "9903f4576980ff7cfd560ca57c665a4b59b3c30d"
          }
        ],
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "type": "sha1",
        "valid_from": "2026-10-01T21:20:52.000Z",
        "valid_until": "2027-07-19T08:30:36.557Z",
        "validity_status": "active",
        "value": "9903f4576980ff7cfd560ca57c665a4b59b3c30d"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02",
        "description_available": false,
        "object_id": "90138976-4154-415b-9c1c-fb802e6e9e09",
        "object_ids": [
          "90138976-4154-415b-9c1c-fb802e6e9e09",
          "f2166b03-7941-4b25-b904-ea8805c0214e"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "90138976-4154-415b-9c1c-fb802e6e9e09",
            "valid_from": "2026-10-01T21:20:52.000Z",
            "valid_until": "2027-07-19T08:30:36.557Z",
            "validity_status": "active",
            "value": "0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "f2166b03-7941-4b25-b904-ea8805c0214e",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02"
          }
        ],
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "type": "sha256",
        "valid_from": "2026-10-01T21:20:52.000Z",
        "valid_until": "2027-07-19T08:30:36.557Z",
        "validity_status": "active",
        "value": "0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "1e22fde68d3277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90",
        "description_available": false,
        "object_id": "dde0696a-3f20-4865-8cd7-88a480b9eb10",
        "object_ids": [
          "dd0e0801-f460-4a91-992f-f1558697c94c",
          "dde0696a-3f20-4865-8cd7-88a480b9eb10"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "dde0696a-3f20-4865-8cd7-88a480b9eb10",
            "valid_from": "2026-10-01T21:20:52.000Z",
            "valid_until": "2027-07-19T08:30:36.557Z",
            "validity_status": "active",
            "value": "1e22fde68d3277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "dd0e0801-f460-4a91-992f-f1558697c94c",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "1e22fde68d3277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90"
          }
        ],
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "type": "sha256",
        "valid_from": "2026-10-01T21:20:52.000Z",
        "valid_until": "2027-07-19T08:30:36.557Z",
        "validity_status": "active",
        "value": "1e22fde68d3277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45",
        "description_available": false,
        "object_id": "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9",
        "object_ids": [
          "35337a91-33d9-4551-9099-54ebc4e3e2e0",
          "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "d0b9b15d-d2c5-40f0-bd4d-b6a9a131e6a9",
            "valid_from": "2026-10-01T21:20:52.000Z",
            "valid_until": "2027-07-19T08:30:36.557Z",
            "validity_status": "active",
            "value": "c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "35337a91-33d9-4551-9099-54ebc4e3e2e0",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45"
          }
        ],
        "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit",
        "type": "sha256",
        "valid_from": "2026-10-01T21:20:52.000Z",
        "valid_until": "2027-07-19T08:30:36.557Z",
        "validity_status": "active",
        "value": "c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45"
      }
    ],
    "mentioned": [
      {
        "confidence": 50,
        "evidence_id": "e0ef6c2e-25c9-4fa7-a905-255a1d981f1e",
        "name": "TIKTOUK",
        "role": "mentionné",
        "type": "Malware"
      },
      {
        "confidence": 80,
        "evidence_id": "802136a0-c009-4e53-a497-45699929f503",
        "name": "CVE-2026-60137",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 80,
        "evidence_id": "4f275781-30af-4e1e-affa-090a4b6c7f16",
        "name": "CVE-2026-63030",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 80,
        "evidence_id": "c0f8d113-129e-4f2c-a0c5-80d76dfc4179",
        "name": "CVE-2026-88771",
        "role": "mentionné",
        "type": "Vulnerability"
      }
    ],
    "mitre": {
      "associated_repertoire": [],
      "direct_techniques": []
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-10-01T21:20:51.832Z",
        "created_at": "2026-10-03T03:24:09.270Z",
        "modified": "2026-10-03T03:24:18.857Z",
        "published": "2026-10-01T21:20:51.832Z",
        "updated_at": "2026-10-03T03:24:18.857Z"
      },
      "description_available": true,
      "id": "33f9a404-a31a-4e7f-b8e1-0aac8a0afb9b",
      "is_inferred": false,
      "labels": [
        "aws credentials",
        "configuration exposure",
        "credential theft",
        "cve-2026-60137",
        "cve-2026-63030",
        "javascript scanning",
        "rest api probing",
        "smtp plugin decryption",
        "tiktouk",
        "wordpress"
      ],
      "lang": "en",
      "name": "TIKTOUK: Tracing a WordPress Credential Collection Toolkit",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-10-01T21:20:51.832Z",
      "references": [
        {
          "external_id": null,
          "id": "eeb23452-0c40-4e85-bb56-dc17a0ba0b67",
          "source_name": "alien-vault",
          "url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit"
        },
        {
          "external_id": "6abeceb3ed88945bc5661c7d",
          "id": "e35e15cc-94f9-41fa-9d68-458e7d0ff064",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6abeceb3ed88945bc5661c7d"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit"
    },
    "targets": [],
    "techniques": [],
    "vulnerabilities": [
      "CVE-2026-60137",
      "CVE-2026-63030",
      "CVE-2026-88771"
    ]
  },
  "report_id": "33f9a404-a31a-4e7f-b8e1-0aac8a0afb9b",
  "schema_version": 1,
  "selected_date": "2026-10-01",
  "source_url": "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit"
}